@workos-inc/node 10.6.0 → 10.8.0

package/lib/{factory-nPldaSjn.d.mts → factory-B8vTFojy.d.cts}

@@ -76,6 +76,11 @@ type RequestHeaders = Record<string, string | number | string[]>;
 type RequestOptions = {
   params?: Record<string, any>;
   headers?: RequestHeaders;
+  /**
+   * Maximum number of retries for this request, overriding the client-wide
+   * `maxRetries`. Set to `0` to disable retries for this request.
+   */
+  maxRetries?: number;
 };
 type ResponseHeaderValue = string | string[];
 type ResponseHeaders = Record<string, ResponseHeaderValue>;
@@ -93,14 +98,24 @@ interface HttpClientResponseInterface {
 }
 //#endregion
 //#region src/common/net/http-client.d.ts
+interface HttpClientOptions extends RequestInit {
+  /** Per-request timeout in milliseconds. */
+  timeout?: number;
+  /**
+   * Maximum number of retries for transient failures. Set to `0` to disable
+   * automatic retries entirely. Defaults to {@link DEFAULT_MAX_RETRY_ATTEMPTS}.
+   */
+  maxRetries?: number;
+}
 declare abstract class HttpClient implements HttpClientInterface {
   readonly baseURL: string;
-  readonly options?: RequestInit | undefined;
-  readonly MAX_RETRY_ATTEMPTS = 3;
+  readonly options?: HttpClientOptions | undefined;
+  readonly MAX_RETRY_ATTEMPTS: number;
   readonly BACKOFF_MULTIPLIER = 1.5;
   readonly MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500;
+  readonly MAXIMUM_SLEEP_TIME_IN_MILLISECONDS = 8000;
   readonly RETRY_STATUS_CODES: number[];
-  constructor(baseURL: string, options?: RequestInit | undefined);
+  constructor(baseURL: string, options?: HttpClientOptions | undefined);
   abstract get(path: string, options: RequestOptions): Promise<HttpClientResponseInterface>;
   abstract post<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
   abstract put<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
@@ -111,9 +126,23 @@ declare abstract class HttpClient implements HttpClientInterface {
   static getQueryString(queryObj?: Record<string, any>): string | undefined;
   static getContentTypeHeader(entity: any): RequestHeaders | undefined;
   static getBody(entity: any): BodyInit | null | undefined;
-  static isPathRetryable(path: string): boolean;
+  /**
+   * Generate a random idempotency key used to make retried write requests
+   * safe. Mirrors the behavior of the other WorkOS SDKs (Kotlin, Go), which
+   * attach an `Idempotency-Key` header to POST requests that did not already
+   * specify one, so a retried request is not applied more than once.
+   */
+  static generateIdempotencyKey(): string;
+  /**
+   * Parse a `Retry-After` header value into milliseconds. Supports both the
+   * delay-seconds form (e.g. `120`) and the HTTP-date form. The result is
+   * capped at {@link MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS}. Returns
+   * `null` when the value is absent or unparseable so the caller falls back
+   * to the computed exponential backoff.
+   */
+  static parseRetryAfter(headerValue: string | null | undefined): number | null;
   private getSleepTimeInMilliseconds;
-  sleep: (retryAttempt: number) => Promise<unknown>;
+  sleep: (retryAttempt: number, retryAfterMs?: number | null) => Promise<unknown>;
 }
 //#endregion
 //#region src/common/crypto/decode-payload.d.ts
@@ -608,6 +637,16 @@ interface RoleAssignmentResourceResponse {
   external_id: string;
   resource_type_slug: string;
 }
+interface RoleAssignmentSource {
+  /** Whether the role was assigned directly or derived from a group. */
+  type: 'direct' | 'group';
+  /** The ID of the group role assignment the role was derived from, or null if direct. */
+  groupRoleAssignmentId: string | null;
+}
+interface RoleAssignmentSourceResponse {
+  type: 'direct' | 'group';
+  group_role_assignment_id: string | null;
+}
 interface RoleAssignment {
   /** Distinguishes the role assignment object. */
   object: 'role_assignment';
@@ -619,6 +658,8 @@ interface RoleAssignment {
   role: RoleAssignmentRole;
   /** The resource to which the role is assigned. */
   resource: RoleAssignmentResource;
+  /** The origin of the role assignment. */
+  source: RoleAssignmentSource;
   /** An ISO 8601 timestamp. */
   createdAt: string;
   /** An ISO 8601 timestamp. */
@@ -630,6 +671,7 @@ interface RoleAssignmentResponse {
   organization_membership_id: string;
   role: RoleAssignmentRole;
   resource: RoleAssignmentResourceResponse;
+  source: RoleAssignmentSourceResponse;
   created_at: string;
   updated_at: string;
 }
@@ -2397,6 +2439,10 @@ interface ApiKey {
   owner: {
     type: 'organization';
     id: string;
+  } | {
+    type: 'user';
+    id: string;
+    organizationId: string;
   };
   /** A descriptive name for the API Key. */
   name: string;
@@ -2417,6 +2463,10 @@ interface SerializedApiKey {
   owner: {
     type: 'organization';
     id: string;
+  } | {
+    type: 'user';
+    id: string;
+    organization_id: string;
   };
   name: string;
   obfuscated_value: string;
@@ -2481,9 +2531,15 @@ interface ValidateApiKeyOptions {
 }
 interface ValidateApiKeyResponse {
   apiKey: ApiKey | null;
+  /**
+   * The ID of the agent registration this API key was issued for. Present only
+   * when the API key is assigned to an agent registration.
+   */
+  agentRegistrationId?: string;
 }
 interface SerializedValidateApiKeyResponse {
   api_key: SerializedApiKey | null;
+  agent_registration_id?: string;
 }
 //#endregion
 //#region src/feature-flags/interfaces/add-flag-target-options.interface.d.ts
@@ -3478,6 +3534,8 @@ interface GetOptions {
   warrantToken?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/list.interface.d.ts
@@ -3506,6 +3564,8 @@ interface PatchOptions {
   idempotencyKey?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/post-options.interface.d.ts
@@ -3517,6 +3577,8 @@ interface PostOptions {
   warrantToken?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/put-options.interface.d.ts
@@ -3527,6 +3589,8 @@ interface PutOptions {
   idempotencyKey?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/unprocessable-entity-error.interface.d.ts
@@ -3552,6 +3616,13 @@ interface WorkOSOptions {
   fetchFn?: typeof fetch;
   clientId?: string;
   timeout?: number;
+  /**
+   * Maximum number of automatic retries for transient failures (network
+   * errors and 408/429/5xx responses). Retries use exponential backoff with
+   * jitter and honor the `Retry-After` header (capped at 60 seconds).
+   * Defaults to 3. Set to `0` to disable automatic retries.
+   */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/workos-response-error.interface.d.ts
@@ -3743,12 +3814,7 @@ declare class Actions {
   private signatureProvider;
   constructor(cryptoProvider: CryptoProvider);
   private get computeSignature();
-  get verifyHeader(): ({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -3760,12 +3826,7 @@ declare class Actions {
     payload: ResponsePayload;
     signature: string;
   }>;
-  constructAction({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  constructAction({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -3809,6 +3870,263 @@ declare class PKCE {
   private base64UrlEncode;
 }
 //#endregion
+//#region src/agents/interfaces/agent-registration.interface.d.ts
+/** The lifecycle status of an agent registration. */
+type AgentRegistrationStatus = 'unverified' | 'verified' | 'expired' | 'revoked';
+/** The kind of agent registration, derived from its authentication method. */
+type AgentRegistrationKind = 'anonymous' | 'service_auth' | 'identity_assertion';
+/** The agent identity an agent registration belongs to. */
+interface AgentIdentity {
+  /** Unique identifier of the agent identity. */
+  id: string;
+  /** The Userland user the agent identity is associated with, if any. */
+  userlandUserId: string | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+}
+interface SerializedAgentIdentity {
+  id: string;
+  userland_user_id: string | null;
+  created_at: string;
+  updated_at: string;
+}
+/** The completion of an agent registration claim. */
+interface AgentRegistrationClaimCompletion {
+  /** Unique identifier of the claim completion. */
+  id: string;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+  /** An ISO 8601 timestamp. */
+  expiresAt: string;
+  /** An ISO 8601 timestamp of when the registration was claimed. */
+  claimedAt: string;
+}
+interface SerializedAgentRegistrationClaimCompletion {
+  id: string;
+  created_at: string;
+  updated_at: string;
+  expires_at: string;
+  claimed_at: string;
+}
+/** The claim state of an agent registration. */
+interface AgentRegistrationClaim {
+  /** Unique identifier of the claim. */
+  id: string;
+  /** The completion of the claim, or `null` if it has not been claimed. */
+  claimCompletion: AgentRegistrationClaimCompletion | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+  /** An ISO 8601 timestamp. */
+  expiresAt: string;
+}
+interface SerializedAgentRegistrationClaim {
+  id: string;
+  claim_completion: SerializedAgentRegistrationClaimCompletion | null;
+  created_at: string;
+  updated_at: string;
+  expires_at: string;
+}
+/** A single agent registration. */
+interface AgentRegistration {
+  /** Unique identifier of the agent registration. */
+  id: string;
+  /** The agent identity the registration belongs to. */
+  agentIdentity: AgentIdentity;
+  /** Unique identifier of the Organization the registration belongs to. */
+  organizationId: string;
+  /** The lifecycle status of the registration. */
+  status: AgentRegistrationStatus;
+  /** The kind of registration. */
+  kind: AgentRegistrationKind;
+  /** The claim state of the registration, or `null` if it has none. */
+  claim: AgentRegistrationClaim | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+}
+interface SerializedAgentRegistration {
+  id: string;
+  agent_identity: SerializedAgentIdentity;
+  organization_id: string;
+  status: AgentRegistrationStatus;
+  kind: AgentRegistrationKind;
+  claim: SerializedAgentRegistrationClaim | null;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/agents/interfaces/validate-agent-credential.interface.d.ts
+/** The type of agent credential to validate. */
+type AgentCredentialType = 'api_key' | 'access_token';
+interface ValidateAgentApiKeyOptions {
+  type: 'api_key';
+  /** The opaque API key value to validate. */
+  credential: string;
+}
+interface ValidateAgentAccessTokenOptions {
+  type: 'access_token';
+  /** The access token (JWT) to validate. */
+  credential: string;
+  /**
+   * When `true`, additionally calls the WorkOS API to check whether the token
+   * has been revoked. When `false` or omitted, the token is only decoded and
+   * verified locally against the environment's JWKS — a revoked but
+   * not-yet-expired token will still report as valid.
+   */
+  checkForRevoked?: boolean;
+  /**
+   * The expected token audience (`aud`). Defaults to the client ID the WorkOS
+   * client was initialized with. Pass the resource indicator for
+   * resource-scoped tokens, whose audience is the resource rather than the
+   * client ID. When `checkForRevoked` is set, this is also forwarded to the
+   * WorkOS API so the server verifies the `aud` claim against the same value.
+   */
+  audience?: string;
+}
+/**
+ * Options for validating an agent credential. `checkForRevoked` and `audience`
+ * are only available for `access_token` credentials.
+ */
+type ValidateAgentCredentialOptions = ValidateAgentApiKeyOptions | ValidateAgentAccessTokenOptions;
+interface SerializedValidateAgentCredentialOptions {
+  type: AgentCredentialType;
+  credential: string;
+  audience?: string;
+}
+/**
+ * The decoded claims of an agent access token. The required fields are
+ * guaranteed present: the SDK rejects a token that is missing any of them
+ * rather than returning a partial result.
+ */
+interface AgentAccessTokenClaims {
+  /** The token issuer (`iss`). */
+  issuer: string;
+  /** The token audience (`aud`). */
+  audience: string | string[];
+  /** Unique identifier of the agent registration the token was issued for (`sub`). */
+  registrationId: string;
+  /** The token's unique identifier (`jti`). */
+  jti: string;
+  /** Unique identifier of the Organization the registration belongs to. */
+  organizationId: string;
+  /** The space-separated scopes granted to the token, if any (`scope`). */
+  scope?: string;
+  /** The actor the token acts on behalf of, if any (`act`). */
+  actor?: {
+    sub: string;
+  };
+  /** The time the token expires, in seconds since the epoch (`exp`). */
+  expiresAt: number;
+  /** The time the token was issued, in seconds since the epoch (`iat`). */
+  issuedAt: number;
+}
+/**
+ * A verified agent access token payload. The required claims are the ones the
+ * SDK guarantees on a valid agent credential; `scope` and `act` are genuinely
+ * optional on the token. A decoded payload missing any required claim is
+ * rejected as invalid before it reaches this shape.
+ */
+interface SerializedAgentAccessTokenClaims {
+  iss: string;
+  aud: string | string[];
+  sub: string;
+  jti: string;
+  org_id: string;
+  exp: number;
+  iat: number;
+  scope?: string;
+  act?: {
+    sub: string;
+  };
+  [claim: string]: unknown;
+}
+/** A valid agent credential. */
+interface ValidAgentCredential {
+  valid: true;
+  /** Unique identifier of the agent registration the credential was issued for. */
+  registrationId: string;
+  /**
+   * An ISO 8601 timestamp of when the credential expires, or `null` when it
+   * does not expire.
+   */
+  expiresAt: string | null;
+  /**
+   * The decoded claims of the access token. Populated for `access_token`
+   * credentials; `null` for API keys.
+   */
+  claims: AgentAccessTokenClaims | null;
+}
+/** An invalid agent credential. */
+interface InvalidAgentCredential {
+  valid: false;
+  registrationId: null;
+  expiresAt: null;
+  claims: null;
+}
+/** The result of validating an agent credential. */
+type AgentCredentialValidation = ValidAgentCredential | InvalidAgentCredential;
+interface SerializedAgentCredentialValidation {
+  valid: boolean;
+  registration_id: string | null;
+  expires_at: string | null;
+}
+//#endregion
+//#region src/agents/agents.d.ts
+declare class Agents {
+  private readonly workos;
+  private _jwks?;
+  constructor(workos: WorkOS);
+  /**
+   * Get an agent registration
+   *
+   * Retrieve a single agent registration scoped to the API key's environment.
+   * @param id - Unique identifier of the agent registration.
+   *
+   * @example
+   * "agent_reg_01EHZNVPK3SFK441A1RGBFSHRT"
+   *
+   * @returns {Promise<AgentRegistration>}
+   * @throws {NotFoundException} 404
+   */
+  getRegistration(id: string): Promise<AgentRegistration>;
+  /**
+   * Validate an agent credential
+   *
+   * For `access_token` credentials, the token is decoded and verified locally
+   * against the environment's JWKS and its claims are returned — no network
+   * request is made unless `checkForRevoked` is set, in which case the WorkOS
+   * API is also called to confirm the token has not been revoked.
+   *
+   * For `api_key` credentials, the WorkOS API is always called to validate the
+   * key against the environment.
+   *
+   * @param options - Object containing the credential type and value.
+   * @returns {Promise<AgentCredentialValidation>}
+   */
+  validateCredential(options: ValidateAgentCredentialOptions): Promise<AgentCredentialValidation>;
+  private validateAccessToken;
+  private validateCredentialRemotely;
+  /**
+   * Verifies an access token's signature, audience, and time claims against the
+   * environment's JWKS and returns its decoded claims, or `null` when the token
+   * is invalid (bad signature, wrong audience, expired, malformed, or missing
+   * the agent identity claims). Errors that are not JWT validation failures
+   * (e.g. network errors fetching the JWKS) propagate.
+   *
+   * The audience defaults to the client ID; resource-scoped tokens carry the
+   * resource as their audience and require it to be passed explicitly.
+   */
+  private verifyAccessTokenClaims;
+  private getJWKS;
+}
+//#endregion
 //#region src/common/utils/pagination.d.ts
 declare class AutoPaginatable<ResourceType, ParametersType extends PaginationOptions = PaginationOptions> {
   protected list: List<ResourceType>;
@@ -4694,23 +5012,527 @@ interface SendSessionResponse {
 declare class Passwordless {
   private readonly workos;
   constructor(workos: WorkOS);
-  createSession({
-    redirectURI,
-    expiresIn,
-    ...options
-  }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
+  createSession({ redirectURI, expiresIn, ...options }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
   sendSession(sessionId: string): Promise<SendSessionResponse>;
 }
 //#endregion
-//#region src/pipes/interfaces/access-token.interface.d.ts
-interface AccessToken {
+//#region src/pipes/interfaces/data-integration-credentials-type.interface.d.ts
+declare const DataIntegrationCredentialsType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialsType = (typeof DataIntegrationCredentialsType)[keyof typeof DataIntegrationCredentialsType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-dto.interface.d.ts
+interface DataIntegrationCredentialsDto {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
+  type: DataIntegrationCredentialsType;
+  /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientId?: string;
+  /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientSecret?: string;
+}
+interface DataIntegrationCredentialsDtoResponse {
+  type: DataIntegrationCredentialsType;
+  client_id?: string;
+  client_secret?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/custom-provider-definition-authenticate-via.interface.d.ts
+declare const CustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type CustomProviderDefinitionAuthenticateVia = (typeof CustomProviderDefinitionAuthenticateVia)[keyof typeof CustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/custom-provider-definition.interface.d.ts
+interface CustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. Defaults to a space. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. Defaults to `true`. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: CustomProviderDefinitionAuthenticateVia;
+}
+interface CustomProviderDefinitionResponse {
+  name: string;
+  authorization_url: string;
+  token_url: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: CustomProviderDefinitionAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/create-data-integration-options.interface.d.ts
+interface CreateDataIntegrationOptions {
+  /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
+  provider: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. Defaults to `false`. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
+  scopes?: string[] | null;
+  /** The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
+  customProvider?: CustomProviderDefinition;
+}
+//#endregion
+//#region src/pipes/interfaces/get-data-integration-options.interface.d.ts
+interface GetDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+}
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition-authenticate-via.interface.d.ts
+declare const UpdateCustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type UpdateCustomProviderDefinitionAuthenticateVia = (typeof UpdateCustomProviderDefinitionAuthenticateVia)[keyof typeof UpdateCustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition.interface.d.ts
+interface UpdateCustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name?: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl?: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl?: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: UpdateCustomProviderDefinitionAuthenticateVia;
+}
+interface UpdateCustomProviderDefinitionResponse {
+  name?: string;
+  authorization_url?: string;
+  token_url?: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: UpdateCustomProviderDefinitionAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-options.interface.d.ts
+interface UpdateDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
+  scopes?: string[] | null;
+  /** New credentials for the Data Integration. When provided, rotates the stored client secret. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
+  customProvider?: UpdateCustomProviderDefinition;
+}
+//#endregion
+//#region src/pipes/interfaces/delete-data-integration-options.interface.d.ts
+interface DeleteDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+}
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-api-key-options.interface.d.ts
+interface UpdateDataIntegrationApiKeyOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
+  /** The API key secret to store for this integration. */
+  secret: string;
+}
+//#endregion
+//#region src/pipes/interfaces/authorize-data-integration-options.interface.d.ts
+interface AuthorizeDataIntegrationOptions {
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The ID of the user to authorize. */
+  userId: string;
+  /** An organization ID to scope the authorization to a specific organization. */
+  organizationId?: string;
+  /** The URL to redirect the user to after authorization. */
+  returnTo?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/create-data-integration-credential-options.interface.d.ts
+interface CreateDataIntegrationCredentialOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/get-access-token-options.interface.d.ts
+interface GetAccessTokenOptions {
+  /** The identifier of the integration. */
+  provider: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string | null;
+}
+//#endregion
+//#region src/pipes/interfaces/get-user-connected-account-options.interface.d.ts
+interface GetUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/connected-account-state.interface.d.ts
+declare const ConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type ConnectedAccountState = (typeof ConnectedAccountState)[keyof typeof ConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/create-user-connected-account-options.interface.d.ts
+interface CreateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
+}
+//#endregion
+//#region src/pipes/interfaces/update-user-connected-account-options.interface.d.ts
+interface UpdateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
+}
+//#endregion
+//#region src/pipes/interfaces/delete-user-connected-account-options.interface.d.ts
+interface DeleteUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/list-user-data-providers-options.interface.d.ts
+interface ListUserDataProvidersOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
+  organizationId?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential-type.interface.d.ts
+declare const DataIntegrationCredentialType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialType = (typeof DataIntegrationCredentialType)[keyof typeof DataIntegrationCredentialType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential.interface.d.ts
+/** The credentials configured for the Data Integration. */
+interface DataIntegrationCredential {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
+  type: DataIntegrationCredentialType;
+  /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
+  clientId: string | null;
+  /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
+  redactedClientSecret: string | null;
+}
+interface DataIntegrationCredentialResponse {
+  type: DataIntegrationCredentialType;
+  client_id: string | null;
+  redacted_client_secret: string | null;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider-authenticate-via.interface.d.ts
+declare const DataIntegrationCustomProviderAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type DataIntegrationCustomProviderAuthenticateVia = (typeof DataIntegrationCustomProviderAuthenticateVia)[keyof typeof DataIntegrationCustomProviderAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider.interface.d.ts
+interface DataIntegrationCustomProvider {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string | null;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string | null;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia: DataIntegrationCustomProviderAuthenticateVia;
+}
+interface DataIntegrationCustomProviderResponse {
+  name: string;
+  authorization_url: string | null;
+  token_url: string | null;
+  refresh_token_url: string | null;
+  pkce_enabled: boolean;
+  request_scope_separator: string;
+  scopes_required: boolean;
+  client_secret_required: boolean;
+  additional_authorization_parameters: Record<string, string>;
+  token_body_content_type: string;
+  authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-state.interface.d.ts
+declare const DataIntegrationState: {
+  readonly Valid: "valid";
+  readonly Invalid: "invalid";
+  readonly Requested: "requested";
+};
+type DataIntegrationState = (typeof DataIntegrationState)[keyof typeof DataIntegrationState];
+//#endregion
+//#region src/pipes/interfaces/data-integration.interface.d.ts
+interface DataIntegration {
+  /** Distinguishes the Data Integration object. */
+  object: 'data_integration';
+  /** Unique identifier of the Data Integration. */
+  id: string;
+  /** The provider slug for this Data Integration. */
+  slug: string;
+  /** The integration type derived from the provider. */
+  integrationType: string;
+  /** An optional description of the Data Integration. */
+  description: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled: boolean;
+  /** The state of the Data Integration. */
+  state: DataIntegrationState;
+  /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
+  scopes: string[] | null;
+  /** The OAuth redirect URI to register with the provider when configuring the custom application. */
+  redirectUri: string;
+  /** The credentials configured for the Data Integration. */
+  credentials: DataIntegrationCredential;
+  /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
+  customProvider: DataIntegrationCustomProvider | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: Date;
+  /** An ISO 8601 timestamp. */
+  updatedAt: Date;
+}
+interface DataIntegrationResponse {
+  object: 'data_integration';
+  id: string;
+  slug: string;
+  integration_type: string;
+  description: string | null;
+  enabled: boolean;
+  state: DataIntegrationState;
+  scopes: string[] | null;
+  redirect_uri: string;
+  credentials: DataIntegrationCredentialResponse;
+  custom_provider: DataIntegrationCustomProviderResponse | null;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/pipes/interfaces/connected-account-auth-method.interface.d.ts
+declare const ConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type ConnectedAccountAuthMethod = (typeof ConnectedAccountAuthMethod)[keyof typeof ConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/connected-account.interface.d.ts
+interface ConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: ConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: ConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
+}
+interface ConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: ConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: ConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-authorize-url-response.interface.d.ts
+interface DataIntegrationAuthorizeUrlResponse {
+  /** The OAuth authorization URL to redirect the user to. */
+  url: string;
+}
+interface DataIntegrationAuthorizeUrlResponseWire {
+  url: string;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-credential.interface.d.ts
+/** The credential object containing the vended secret. */
+interface DataIntegrationCredentialsResponseCredential {
+  /** Distinguishes the credential object. */
+  object: 'credential';
+  /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
+  authMethod: 'oauth';
+  /** The OAuth access token. */
+  value: string;
+  /** The ISO-8601 formatted timestamp indicating when the credential expires. */
+  expiresAt: string | null;
+  /** The scopes granted to the access token. */
+  scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
+  missingScopes: string[];
+}
+interface DataIntegrationCredentialsResponseCredentialResponse {
+  object: 'credential';
+  auth_method: 'oauth';
+  value: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-error.interface.d.ts
+declare const DataIntegrationCredentialsResponseError: {
+  readonly NotInstalled: "not_installed";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type DataIntegrationCredentialsResponseError = (typeof DataIntegrationCredentialsResponseError)[keyof typeof DataIntegrationCredentialsResponseError];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response.interface.d.ts
+interface DataIntegrationCredentialsResponse {
+  /** Indicates credentials are available. */
+  active?: true;
+  /** The credential object containing the vended secret. */
+  credential?: DataIntegrationCredentialsResponseCredential;
+  /**
+   * The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully.
+   * - `"not_installed"`: The user does not have the integration installed.
+   * - `"needs_reauthorization"`: The user needs to reauthorize the integration.
+   */
+  error?: DataIntegrationCredentialsResponseError;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-access-token-response-access-token.interface.d.ts
+/** The [access token](https://workos.com/docs/reference/pipes/access-token) object, present when `active` is `true`. */
+interface DataIntegrationAccessTokenResponseAccessToken {
+  /** Distinguishes the access token object. */
   object: 'access_token';
+  /** The OAuth access token for the connected integration. */
   accessToken: string;
+  /** The ISO-8601 formatted timestamp indicating when the access token expires. */
   expiresAt: Date | null;
+  /** The scopes granted to the access token. */
   scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
   missingScopes: string[];
 }
-interface SerializedAccessToken {
+interface DataIntegrationAccessTokenResponseAccessTokenResponse {
   object: 'access_token';
   access_token: string;
   expires_at: string | null;
@@ -4718,44 +5540,412 @@ interface SerializedAccessToken {
   missing_scopes: string[];
 }
 //#endregion
-//#region src/pipes/interfaces/get-access-token.interface.d.ts
-interface GetAccessTokenOptions {
-  userId: string;
-  organizationId?: string | null;
+//#region src/pipes/interfaces/data-integration-access-token-response.interface.d.ts
+type DataIntegrationAccessTokenResponse = {
+  active: true;
+  accessToken: DataIntegrationAccessTokenResponseAccessToken;
+} | {
+  active: false;
+  error: 'needs_reauthorization' | 'not_installed';
+};
+type DataIntegrationAccessTokenResponseWire = {
+  active: true;
+  access_token: DataIntegrationAccessTokenResponseAccessTokenResponse;
+} | {
+  active: false;
+  error: 'needs_reauthorization' | 'not_installed';
+};
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-auth-method.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataConnectedAccountAuthMethod = (typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod)[keyof typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-state.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+  readonly Disconnected: "disconnected";
+};
+type DataIntegrationsListResponseDataConnectedAccountState = (typeof DataIntegrationsListResponseDataConnectedAccountState)[keyof typeof DataIntegrationsListResponseDataConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account.interface.d.ts
+interface DataIntegrationsListResponseDataConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
+  /**
+   * Use `user_id` instead.
+   * @deprecated
+   */
+  userlandUserId: string | null;
 }
-interface SerializedGetAccessTokenOptions {
-  user_id: string;
-  organization_id?: string | null;
+interface DataIntegrationsListResponseDataConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+  userland_user_id: string | null;
 }
-interface GetAccessTokenSuccessResponse {
-  active: true;
-  accessToken: AccessToken;
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-auth-methods.interface.d.ts
+declare const DataIntegrationsListResponseDataAuthMethods: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataAuthMethods = (typeof DataIntegrationsListResponseDataAuthMethods)[keyof typeof DataIntegrationsListResponseDataAuthMethods];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-ownership.interface.d.ts
+declare const DataIntegrationsListResponseDataOwnership: {
+  readonly UserlandUser: "userland_user";
+  readonly Organization: "organization";
+};
+type DataIntegrationsListResponseDataOwnership = (typeof DataIntegrationsListResponseDataOwnership)[keyof typeof DataIntegrationsListResponseDataOwnership];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data.interface.d.ts
+interface DataIntegrationsListResponseData {
+  /** Distinguishes the data provider object. */
+  object: 'data_provider';
+  /** The unique identifier of the provider. */
+  id: string;
+  /** The display name of the provider (e.g., "GitHub", "Slack"). */
+  name: string;
+  /** A description of the provider explaining how it will be used, if configured. */
+  description: string | null;
+  /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The type of integration (e.g., `github`, `slack`). */
+  integrationType: string;
+  /** The type of credentials used by the provider (e.g., `oauth2`). */
+  credentialsType: string;
+  /** The OAuth scopes configured for this provider, or `null` if none are configured. */
+  scopes: string[] | null;
+  /** The authentication methods supported by this provider (`oauth`, `api_key`, or both). Defaults to `["oauth"]` if absent. */
+  authMethods?: DataIntegrationsListResponseDataAuthMethods[];
+  /** Whether the provider is owned by a user or organization. */
+  ownership: DataIntegrationsListResponseDataOwnership;
+  /** The timestamp when the provider was created. */
+  createdAt: string;
+  /** The timestamp when the provider was last updated. */
+  updatedAt: string;
+  /** The user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
+  connectedAccount: DataIntegrationsListResponseDataConnectedAccount | null;
 }
-interface GetAccessTokenFailureResponse {
-  active: false;
-  error: 'not_installed' | 'needs_reauthorization';
+interface DataIntegrationsListResponseDataResponse {
+  object: 'data_provider';
+  id: string;
+  name: string;
+  description: string | null;
+  slug: string;
+  integration_type: string;
+  credentials_type: string;
+  scopes: string[] | null;
+  auth_methods?: DataIntegrationsListResponseDataAuthMethods[];
+  ownership: DataIntegrationsListResponseDataOwnership;
+  created_at: string;
+  updated_at: string;
+  connected_account: DataIntegrationsListResponseDataConnectedAccountResponse | null;
 }
-type GetAccessTokenResponse = GetAccessTokenSuccessResponse | GetAccessTokenFailureResponse;
-interface SerializedGetAccessTokenSuccessResponse {
-  active: true;
-  access_token: SerializedAccessToken;
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response.interface.d.ts
+interface DataIntegrationsListResponse {
+  /** Indicates this is a list response. */
+  object: 'list';
+  /** A list of [providers](https://workos.com/docs/reference/pipes/provider), each including a [`connected_account`](https://workos.com/docs/reference/pipes/connected-account) field with the user's connection status. */
+  data: DataIntegrationsListResponseData[];
 }
-interface SerializedGetAccessTokenFailureResponse {
-  active: false;
-  error: 'not_installed' | 'needs_reauthorization';
+interface DataIntegrationsListResponseWire {
+  object: 'list';
+  data: DataIntegrationsListResponseDataResponse[];
 }
-type SerializedGetAccessTokenResponse = SerializedGetAccessTokenSuccessResponse | SerializedGetAccessTokenFailureResponse;
 //#endregion
 //#region src/pipes/pipes.d.ts
 declare class Pipes {
   private readonly workos;
   constructor(workos: WorkOS);
-  getAccessToken({
-    provider,
-    ...options
-  }: GetAccessTokenOptions & {
-    provider: string;
-  }): Promise<GetAccessTokenResponse>;
+  /**
+   * List data integrations
+   *
+   * Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers.
+   * @param options - Pagination and filter options.
+   * @returns {Promise<AutoPaginatable<DataIntegration, PaginationOptions>>}
+   * @throws {UnauthorizedException} 401
+   */
+  listDataIntegrations(options?: PaginationOptions): Promise<AutoPaginatable<DataIntegration, PaginationOptions>>;
+  /**
+   * Create a data integration
+   *
+   * Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials, or `organization` to have each organization supply its own. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+   * @param options - Object containing provider.
+   * @param options.provider - The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
+   * @example "github"
+   * @param options.description - An optional description of the Data Integration.
+   * @example "Production GitHub app"
+   * @param options.enabled - Whether the Data Integration is enabled. Defaults to `false`.
+   * @example true
+   * @param options.scopes - The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
+   * @example ["repo","read:org"]
+   * @param options.credentials - The credentials to configure for the Data Integration. Required for both built-in and custom providers.
+   * @param options.customProvider - The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
+   * @returns {Promise<DataIntegration>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  createDataIntegration(options: CreateDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Get a data integration
+   *
+   * Retrieves a data integration by its slug.
+   * @param options - The request options.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @returns {Promise<DataIntegration>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  getDataIntegration(options: GetDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Update a data integration
+   *
+   * Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.
+   * @param options - The request body.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @param options.description - An optional description of the Data Integration.
+   * @example "Production GitHub app"
+   * @param options.enabled - Whether the Data Integration is enabled.
+   * @example true
+   * @param options.scopes - The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
+   * @example ["repo","read:org"]
+   * @param options.credentials - New credentials for the Data Integration. When provided, rotates the stored client secret.
+   * @param options.customProvider - Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
+   * @returns {Promise<DataIntegration>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  updateDataIntegration(options: UpdateDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Delete a data integration
+   *
+   * Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.
+   * @param options - The request options.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @returns {Promise<void>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  deleteDataIntegration(options: DeleteDataIntegrationOptions): Promise<void>;
+  /**
+   * Upsert an API key for a connected account
+   *
+   * Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.
+   * @param options - Object containing userId, secret.
+   * @param options.slug - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.secret - The API key secret to store for this integration.
+   * @example "sk-1234567890abcdef"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  updateDataIntegrationApiKey(options: UpdateDataIntegrationApiKeyOptions): Promise<ConnectedAccount>;
+  /**
+   * Get authorization URL
+   *
+   * Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.
+   * @param options - Object containing userId.
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.userId - The ID of the user to authorize.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An organization ID to scope the authorization to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.returnTo - The URL to redirect the user to after authorization.
+   * @example "https://example.com/callback"
+   * @returns {Promise<DataIntegrationAuthorizeUrlResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   */
+  authorizeDataIntegration(options: AuthorizeDataIntegrationOptions): Promise<DataIntegrationAuthorizeUrlResponse>;
+  /**
+   * Vend credentials for a connected account
+   *
+   * Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.
+   * @param options - Object containing userId.
+   * @param options.slug - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationCredentialsResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  createDataIntegrationCredential(options: CreateDataIntegrationCredentialOptions): Promise<DataIntegrationCredentialsResponse>;
+  /**
+   * Get an access token for a connected account
+   *
+   * Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.
+   * @param options - Object containing userId.
+   * @param options.provider - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationAccessTokenResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  getAccessToken(options: GetAccessTokenOptions): Promise<DataIntegrationAccessTokenResponse>;
+  /**
+   * Get a connected account
+   *
+   * Retrieves a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for a specific provider.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  getUserConnectedAccount(options: GetUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Import a connected account
+   *
+   * Imports a [connected account](https://workos.com/docs/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.
+   * @param options - The request body.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.accessToken - The OAuth access token for the connected account.
+   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+   * @param options.refreshToken - The OAuth refresh token for the connected account.
+   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+   * @example "2025-12-31T23:59:59.000Z"
+   * @param options.scopes - The OAuth scopes granted for this connection.
+   * @example ["repo","user:email"]
+   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+   * @example "connected"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {ConflictException} 409
+   * @throws {UnprocessableEntityException} 422
+   */
+  createUserConnectedAccount(options: CreateUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Update a connected account
+   *
+   * Updates a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) tokens, scopes, or state for a specific provider.
+   * @param options - The request body.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.accessToken - The OAuth access token for the connected account.
+   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+   * @param options.refreshToken - The OAuth refresh token for the connected account.
+   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+   * @example "2025-12-31T23:59:59.000Z"
+   * @param options.scopes - The OAuth scopes granted for this connection.
+   * @example ["repo","user:email"]
+   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+   * @example "connected"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  updateUserConnectedAccount(options: UpdateUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Delete a connected account
+   *
+   * Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<void>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  deleteUserConnectedAccount(options: DeleteUserConnectedAccountOptions): Promise<void>;
+  /**
+   * List providers for a user
+   *
+   * Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](https://workos.com/docs/reference/pipes/connected-account) information where applicable.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationsListResponse>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  listUserDataProviders(options: ListUserDataProvidersOptions): Promise<DataIntegrationsListResponse>;
 }
 //#endregion
 //#region src/radar/interfaces/radar-standalone-assess-request-auth-method.interface.d.ts
@@ -4991,14 +6181,7 @@ declare class AdminPortal {
    * @throws {NotFoundException} 404
    * @throws {UnprocessableEntityException} 422
    */
-  generateLink({
-    intent,
-    organization,
-    returnUrl,
-    successUrl,
-    intentOptions,
-    adminEmails
-  }: {
+  generateLink({ intent, organization, returnUrl, successUrl, intentOptions, adminEmails }: {
     intent?: GenerateLinkIntent;
     organization: string;
     returnUrl?: string;
@@ -5096,11 +6279,7 @@ declare class SSO {
    *
    * @throws Error if neither codeVerifier nor API key is available
    */
-  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({
-    code,
-    clientId,
-    codeVerifier
-  }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
+  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({ code, clientId, codeVerifier }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
   /**
    * Get a User Profile
    *
@@ -5109,9 +6288,7 @@ declare class SSO {
    * @throws {UnauthorizedException} 401
    * @throws {NotFoundException} 404
    */
-  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({
-    accessToken
-  }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
+  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({ accessToken }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
 }
 //#endregion
 //#region src/multi-factor-auth/interfaces/challenge-factor-options.d.ts
@@ -5762,13 +6939,16 @@ type CryptoKey = Extract<Awaited<ReturnType<typeof crypto.subtle.generateKey>>,
  */
 declare const customFetch: unique symbol;
 /** See {@link customFetch}. */
-type FetchImplementation = (/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
-
-url: string, /** Options otherwise sent to {@link !fetch} as the `options` argument */
-
+type FetchImplementation = (
+/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
+url: string,
+/** Options otherwise sent to {@link !fetch} as the `options` argument */
 options: {
-  /** HTTP Headers */headers: Headers; /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
-  method: 'GET'; /** See {@link !Request.redirect} */
+  /** HTTP Headers */
+  headers: Headers;
+  /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
+  method: 'GET';
+  /** See {@link !Request.redirect} */
   redirect: 'manual';
   signal: AbortSignal;
 }) => Promise<Response>;
@@ -5883,11 +7063,16 @@ type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
  * @param options Options for the remote JSON Web Key Set.
  */
 declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
-  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>; /** @ignore */
-  coolingDown: boolean; /** @ignore */
-  fresh: boolean; /** @ignore */
-  reloading: boolean; /** @ignore */
-  reload: () => Promise<void>; /** @ignore */
+  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>;
+  /** @ignore */
+  coolingDown: boolean;
+  /** @ignore */
+  fresh: boolean;
+  /** @ignore */
+  reloading: boolean;
+  /** @ignore */
+  reload: () => Promise<void>;
+  /** @ignore */
   jwks: () => JSONWebKeySet | undefined;
 };
 //#endregion
@@ -5928,9 +7113,7 @@ declare class CookieSession {
    *
    * @returns The URL to redirect the user to for logging out.
    */
-  getLogoutUrl({
-    returnTo
-  }?: {
+  getLogoutUrl({ returnTo }?: {
     returnTo?: string;
   }): Promise<string>;
   private isValidJwt;
@@ -6048,17 +7231,11 @@ declare class UserManagement {
   authenticateWithRadarSmsChallenge(payload: AuthenticateWithRadarSmsChallengeOptions): Promise<AuthenticationResponse>;
   /** Authenticate with Radar email challenge. */
   authenticateWithRadarEmailChallenge(payload: AuthenticateWithRadarEmailChallengeOptions): Promise<AuthenticationResponse>;
-  authenticateWithSessionCookie({
-    sessionData,
-    cookiePassword
-  }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+  authenticateWithSessionCookie({ sessionData, cookiePassword }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
   private isValidJwt;
   private prepareAuthenticationResponse;
   private sealSessionDataFromAuthenticationResponse;
-  getSessionFromCookie({
-    sessionData,
-    cookiePassword
-  }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
+  getSessionFromCookie({ sessionData, cookiePassword }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
   /**
    * Get an email verification code
    *
@@ -6076,9 +7253,7 @@ declare class UserManagement {
    * @throws {NotFoundException} 404
    * @throws {RateLimitExceededException} 429
    */
-  sendVerificationEmail({
-    userId
-  }: SendVerificationEmailOptions): Promise<{
+  sendVerificationEmail({ userId }: SendVerificationEmailOptions): Promise<{
     user: User;
   }>;
   /**
@@ -6110,10 +7285,7 @@ declare class UserManagement {
    * @throws {NotFoundException} 404
    * @throws {UnprocessableEntityException} 422
    */
-  verifyEmail({
-    code,
-    userId
-  }: VerifyEmailOptions): Promise<{
+  verifyEmail({ code, userId }: VerifyEmailOptions): Promise<{
     user: User;
   }>;
   /**
@@ -7859,6 +9031,7 @@ declare class WorkOS {
   readonly pkce: PKCE;
   private readonly hasApiKey;
   readonly actions: Actions;
+  readonly agents: Agents;
   readonly apiKeys: ApiKeys;
   readonly auditLogs: AuditLogs;
   readonly authorization: Authorization;
@@ -8229,12 +9402,7 @@ declare class Webhooks {
   deleteWebhookEndpoint(options: DeleteWebhookEndpointOptions): Promise<void>;
   private _signatureProvider?;
   private get signatureProvider();
-  get verifyHeader(): ({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -8242,12 +9410,7 @@ declare class Webhooks {
   }) => Promise<boolean>;
   get computeSignature(): (timestamp: any, payload: WebhookPayload, secret: string) => Promise<string>;
   get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
-  constructEvent({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  constructEvent({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -8323,12 +9486,7 @@ declare class BadRequestException extends Error implements RequestException {
   readonly code?: string;
   readonly errors?: unknown[];
   readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
+  constructor({ code, errors, message, requestID }: {
     code?: string;
     errors?: unknown[];
     message?: string;
@@ -8342,12 +9500,7 @@ declare class ConflictException extends Error implements RequestException {
   readonly name = "ConflictException";
   readonly requestID: string;
   readonly code?: string;
-  constructor({
-    error,
-    message,
-    requestID,
-    code
-  }: {
+  constructor({ error, message, requestID, code }: {
     error?: string;
     message?: string;
     requestID: string;
@@ -8369,12 +9522,7 @@ declare class NotFoundException extends Error implements RequestException {
   readonly message: string;
   readonly code?: string;
   readonly requestID: string;
-  constructor({
-    code,
-    message,
-    path,
-    requestID
-  }: {
+  constructor({ code, message, path, requestID }: {
     code?: string;
     message?: string;
     path: string;
@@ -8404,7 +9552,6 @@ declare class RateLimitExceededException extends GenericServerException {
   /**
    * The number of seconds to wait before retrying the request.
    */
-
   retryAfter: number | null);
 }
 //#endregion
@@ -8430,12 +9577,7 @@ declare class UnprocessableEntityException extends Error implements RequestExcep
   readonly message: string;
   readonly code?: string;
   readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
+  constructor({ code, errors, message, requestID }: {
     code?: string;
     errors?: UnprocessableEntityError[];
     message?: string;
@@ -8581,5 +9723,5 @@ interface ConfidentialClientOptions extends WorkOSOptions {
 declare function createWorkOS(options: PublicClientOptions): PublicWorkOS;
 declare function createWorkOS(options: ConfidentialClientOptions): WorkOS;
 //#endregion
-export { ReadObjectMetadataResponse as $, PermissionUpdatedEventResponse as $a, SerializedCreateMagicAuthOptions as $c, AuthorizationResource as $d, CryptoProvider as $f, GroupMemberAddedEventResponse as $i, AuthenticateUserWithEmailVerificationCredentials as $l, AutoPaginatable as $n, RuntimeClientStats as $o, AuthenticationPasswordFailedEventResponse as $r, ResetPasswordOptions as $s, RadarStandaloneAssessRequestAction as $t, RemoveGroupRoleAssignmentsOptions as $u, ApiKeyRequiredException as A, OrganizationMembershipCreated as Aa, OrganizationMembershipStatus as Ac, SerializedListRoleAssignmentsOptions as Ad, EnvironmentRoleListResponse as Af, DsyncUserDeletedEvent as Ai, UserResponse as Al, ExternalAuthCompleteResponse as An, VaultDekReadEventResponse as Ao, GetOptions as Ar, SerializedCreateOrganizationDomainOptions as As, SerializedAuditLogExportOptions as At, DirectoryUserResponse as Au, ObjectSummaryResponse as B, OrganizationRoleUpdatedEvent as Ba, EnrollAuthFactorOptions as Bc, ListResourcesForMembershipOptionsWithParentId as Bd, DirectoryResponse as Bf, FlagCreatedEvent as Bi, SerializedAuthenticateWithPasswordOptions as Bl, CreateM2MApplicationResponse as Bn, SerializedUpdateGroupOptions as Bo, AuthenticationMagicAuthSucceededEvent as Br, Session as Bs, EnrollFactorOptions as Bt, RoleList as Bu, BadRequestException as C, OrganizationDomainDeletedEventResponse as Ca, SerializedListOrganizationMembershipsOptions as Cc, AssignRoleOptionsWithResourceId as Cd, SetEnvironmentRolePermissionsOptions as Cf, DsyncGroupUpdatedEventResponse as Ci, SessionCookieData as Cl, ConnectApplicationM2M as Cn, VaultDataReadEvent as Co, WorkOSOptions as Cr, OrganizationDomainVerificationFailed as Cs, AuditLogSchema as Ct, ConnectionDomain as Cu, isAuthenticationErrorData as D, OrganizationDomainVerificationFailedEventResponse as Da, BaseOrganizationMembershipResponse as Dc, ListRoleAssignmentsForResourceOptions as Dd, SerializedCreateEnvironmentRoleOptions as Df, DsyncGroupUserRemovedEventResponse as Di, CreateUserResponse as Dl, ConnectApplicationResponse as Dn, VaultDekDecryptedEvent as Do, PatchOptions as Dr, OrganizationDomainState as Ds, AuditLogExport as Dt, SSOPKCEAuthorizationURLResult as Du, AuthenticationException as E, OrganizationDomainVerificationFailedEvent as Ea, BaseOrganizationMembership as Ec, ListRoleAssignmentsForResourceByExternalIdOptions as Ed, CreateEnvironmentRoleOptions as Ef, DsyncGroupUserRemovedEvent as Ei, AuthenticationResponseResponse as El, ConnectApplicationOAuthResponse as En, VaultDataUpdatedEventResponse as Eo, PostOptions as Er, OrganizationDomainResponse as Es, AuditLogTargetSchema as Et, SSOAuthorizationURLOptions as Eu, UpdateWebhookEndpointEvents as F, OrganizationMembershipUpdatedResponse as Fa, Invitation as Fc, RoleAssignmentRole as Fd, SerializedListDirectoriesOptions as Ff, EmailVerificationCreatedEventResponse as Fi, AuthenticateUserWithRefreshTokenCredentials as Fl, DeleteApplicationOptions as Fn, VaultNamesListedEvent as Fo, ApiKeyRevokedEventResponse as Fr, SerializedUpdateUserOptions as Fs, FactorResponse as Ft, OrganizationRoleEventResponse as Fu, ObjectMetadata as G, PasswordResetCreatedEventResponse as Ga, EmailVerificationResponse as Gc, AuthorizationCheckResult as Gd, EventDirectoryResponse as Gf, FlagRuleUpdatedEventResponse as Gi, AuthenticateWithRadarSmsChallengeOptions as Gl, ListApplicationsOptions as Gn, Group as Go, AuthenticationOAuthFailedEventResponse as Gr, SendRadarSmsChallengeResponse as Gs, RadarListEntryAlreadyPresentResponseWire as Gt, GroupRoleAssignmentEntry as Gu, ObjectVersionResponse as H, OrganizationUpdatedEvent as Ha, EmailVerification as Hc, AuthorizationCheckOptions as Hd, DirectoryStateResponse as Hf, FlagDeletedEvent as Hi, AuthenticateWithOrganizationSelectionOptions as Hl, CreateOAuthApplicationResponse as Hn, RemoveGroupOrganizationMembershipOptions as Ho, AuthenticationMfaSucceededEvent as Hr, SessionStatus as Hs, ChallengeResponse as Ht, ListEffectivePermissionsByExternalIdOptions as Hu, UpdateWebhookEndpointStatus as I, OrganizationRoleCreatedEvent as Ia, InvitationEvent as Ic, ListMembershipsForResourceByExternalIdOptions as Id, PaginationOptions as If, Event as Ii, AuthenticateWithRefreshTokenOptions as Il, UpdateApplicationOptions as In, VaultNamesListedEventResponse as Io, AuthenticationEmailVerificationSucceededEvent as Ir, UpdateUserOptions as Is, FactorWithSecrets as It, OrganizationRoleResponse as Iu, ActorResponse as J, PermissionCreatedEvent as Ja, CreatePasswordResetOptions as Jc, DeleteAuthorizationResourceByExternalIdOptions as Jd, HttpClientResponseInterface as Jf, GroupCreatedEvent as Ji, AuthenticateWithRadarEmailChallengeOptions as Jl, UserConsentOptionResponse as Jn, DeleteGroupOptions as Jo, AuthenticationPasskeyFailedEvent as Jr, SendInvitationOptions as Js, RadarStandaloneResponseBlocklistType as Jt, GroupRoleAssignmentEntryWithResourceId as Ju, ObjectMetadataResponse as K, PasswordResetSucceededEvent as Ka, CreateUserOptions as Kc, SerializedAuthorizationCheckOptions as Kd, HttpClient as Kf, FlagUpdatedEvent as Ki, SerializedAuthenticateWithRadarSmsChallengeOptions as Kl, CompleteOAuth2Options as Kn, GroupResponse as Ko, AuthenticationOAuthSucceededEvent as Kr, SendRadarSmsChallengeResponseResponse as Ks, RadarStandaloneResponse as Kt, GroupRoleAssignmentEntryForOrganization as Ku, CreateWebhookEndpointEvents as L, OrganizationRoleCreatedEventResponse as La, InvitationEventResponse as Lc, ListMembershipsForResourceOptions as Ld, DirectoryGroup as Lf, EventBase as Li, SerializedAuthenticateWithRefreshTokenOptions as Ll, GetApplicationOptions as Ln, DataKey as Lo, AuthenticationEmailVerificationSucceededEventResponse as Lr, SerializedUpdateOrganizationMembershipOptions as Ls, FactorWithSecretsResponse as Lt, Role as Lu, WebhookEndpoint as M, OrganizationMembershipDeleted as Ma, SerializedListInvitationsOptions as Mc, RoleAssignmentResource as Md, ListDirectoryUsersOptions as Mf, DsyncUserUpdatedEvent as Mi, ImpersonatorResponse as Ml, DeleteClientSecretOptions as Mn, VaultKekCreatedEventResponse as Mo, ApiKeyCreatedEvent as Mr, VerifyEmailOptions as Ms, VerifyResponseResponse as Mt, DirectoryUserWithGroupsResponse as Mu, WebhookEndpointResponse as N, OrganizationMembershipDeletedResponse as Na, ListGroupsForOrganizationMembershipOptions as Nc, RoleAssignmentResourceResponse as Nd, ListDirectoryGroupsOptions as Nf, DsyncUserUpdatedEventResponse as Ni, AuthenticateWithRefreshTokenPublicClientOptions as Nl, CreateApplicationClientSecretOptions as Nn, VaultMetadataReadEvent as No, ApiKeyCreatedEventResponse as Nr, SerializedUpdateUserPasswordOptions as Ns, VerifyChallengeOptions as Nt, ListOrganizationRolesResponse as Nu, GenericServerException as O, OrganizationDomainVerifiedEvent as Oa, OrganizationMembership as Oc, SerializedListRoleAssignmentsForResourceOptions as Od, EnvironmentRole as Of, DsyncUserCreatedEvent as Oi, CreateUserResponseResponse as Ol, ConnectApplicationRedirectUri as On, VaultDekDecryptedEventResponse as Oo, List as Or, OrganizationDomainVerificationStrategy as Os, AuditLogExportResponse as Ot, DefaultCustomAttributes as Ou, WebhookEndpointStatus as P, OrganizationMembershipUpdated as Pa, ListAuthFactorsOptions as Pc, RoleAssignmentResponse as Pd, ListDirectoriesOptions as Pf, EmailVerificationCreatedEvent as Pi, SerializedAuthenticateWithRefreshTokenPublicClientOptions as Pl, ListApplicationClientSecretsOptions as Pn, VaultMetadataReadEventResponse as Po, ApiKeyRevokedEvent as Pr, UpdateUserPasswordOptions as Ps, Factor as Pt, OrganizationRoleEvent as Pu, UpdateObjectOptions as Q, PermissionUpdatedEvent as Qa, CreateMagicAuthOptions as Qc, SerializedListAuthorizationResourcesOptions as Qd, ResponseHeaders as Qf, GroupMemberAddedEvent as Qi, SerializedAuthenticateWithMagicAuthOptions as Ql, UserObjectResponse as Qn, SerializedAddGroupOrganizationMembershipOptions as Qo, AuthenticationPasswordFailedEvent as Qr, serializeRevokeSessionOptions as Qs, RadarListType as Qt, BaseRemoveGroupRoleAssignmentsOptions as Qu, WorkOS as R, OrganizationRoleDeletedEvent as Ra, InvitationResponse as Rc, ListResourcesForMembershipOptions as Rd, DirectoryGroupResponse as Rf, EventName as Ri, AuthenticateUserWithPasswordCredentials as Rl, CreateApplicationOptions as Rn, DataKeyPair as Ro, AuthenticationMagicAuthFailedEvent as Rr, UpdateOrganizationMembershipOptions as Rs, Sms as Rt, RoleEvent as Ru, ConflictException as S, OrganizationDomainDeletedEvent as Sa, ListOrganizationMembershipsOptions as Sc, AssignRoleOptionsWithResourceExternalId as Sd, AddEnvironmentRolePermissionOptions as Sf, DsyncGroupUpdatedEvent as Si, AuthenticateWithSessionCookieSuccessResponse as Sl, ConnectApplication as Sn, VaultDataDeletedEventResponse as So, WorkOSResponseError as Sr, SerializedApiKey as Ss, AuditLogActorSchema as St, Connection as Su, AuthenticationErrorData as T, OrganizationDomainUpdatedEventResponse as Ta, AuthorizationOrganizationMembershipResponse as Tc, SerializedAssignRoleOptions as Td, UpdateEnvironmentRoleOptions as Tf, DsyncGroupUserAddedEventResponse as Ti, AuthenticationResponse as Tl, ConnectApplicationOAuth as Tn, VaultDataUpdatedEvent as To, PutOptions as Tr, OrganizationDomain as Ts, AuditLogSchemaResponse as Tt, ConnectionType as Tu, VaultObject as U, OrganizationUpdatedResponse as Ua, EmailVerificationEvent as Uc, AuthorizationCheckOptionsWithResourceExternalId as Ud, DirectoryType as Uf, FlagDeletedEventResponse as Ui, SerializedAuthenticateWithOrganizationSelectionOptions as Ul, RedirectUriInput as Un, ListGroupsOptions as Uo, AuthenticationMfaSucceededEventResponse as Ur, SendVerificationEmailOptions as Us, ChallengeFactorOptions as Ut, ListEffectivePermissionsOptions as Uu, ObjectVersion as V, OrganizationRoleUpdatedEventResponse as Va, SerializedEnrollUserInMfaFactorOptions as Vc, SerializedListResourcesForMembershipOptions as Vd, DirectoryState as Vf, FlagCreatedEventResponse as Vi, AuthenticateUserWithOrganizationSelectionCredentials as Vl, CreateOAuthApplication as Vn, UpdateGroupOptions as Vo, AuthenticationMagicAuthSucceededEventResponse as Vr, SessionResponse as Vs, Challenge as Vt, RoleResponse as Vu, VaultObjectResponse as W, PasswordResetCreatedEvent as Wa, EmailVerificationEventResponse as Wc, AuthorizationCheckOptionsWithResourceId as Wd, EventDirectory as Wf, FlagRuleUpdatedEvent as Wi, AuthenticateUserWithRadarSmsChallengeCredentials as Wl, RedirectUriInputResponse as Wn, ListGroupOrganizationMembershipsOptions as Wo, AuthenticationOAuthFailedEvent as Wr, SendRadarSmsChallengeOptions as Ws, RadarListEntryAlreadyPresentResponse as Wt, BaseGroupRoleAssignmentEntry as Wu, CreateDataKeyResponseWire as X, PermissionDeletedEvent as Xa, CreateOrganizationMembershipOptions as Xc, GetAuthorizationResourceByExternalIdOptions as Xd, RequestOptions as Xf, GroupDeletedEvent as Xi, AuthenticateUserWithMagicAuthCredentials as Xl, UserConsentOptionChoiceResponse as Xn, SerializedCreateGroupOptions as Xo, AuthenticationPasskeySucceededEvent as Xr, RevokeSessionOptions as Xs, RadarStandaloneResponseVerdict as Xt, SerializedGroupRoleAssignmentEntry as Xu, CreateDataKeyResponse as Y, PermissionCreatedEventResponse as Ya, SerializedCreatePasswordResetOptions as Yc, UpdateAuthorizationResourceByExternalIdOptions as Yd, RequestHeaders as Yf, GroupCreatedEventResponse as Yi, SerializedAuthenticateWithRadarEmailChallengeOptions as Yl, UserConsentOptionChoice as Yn, CreateGroupOptions as Yo, AuthenticationPasskeyFailedEventResponse as Yr, SerializedSendInvitationOptions as Ys, RadarStandaloneResponseControl as Yt, ReplaceGroupRoleAssignmentsOptions as Yu, UpdateObjectEntity as Z, PermissionDeletedEventResponse as Za, SerializedCreateOrganizationMembershipOptions as Zc, ListAuthorizationResourcesOptions as Zd, ResponseHeaderValue as Zf, GroupDeletedEventResponse as Zi, AuthenticateWithMagicAuthOptions as Zl, UserObject as Zn, AddGroupOrganizationMembershipOptions as Zo, AuthenticationPasskeySucceededEventResponse as Zr, SerializedRevokeSessionOptions as Zs, RadarListAction as Zt, SerializedReplaceGroupRoleAssignmentsOptions as Zu, SignatureVerificationException as _, OrganizationCreatedResponse as _a, ListUsersOptions as _c, RemoveRoleOptions as _d, SerializedUpdateOrganizationRoleOptions as _f, DsyncDeletedEventResponse as _i, AuthenticateWithTotpOptions as _l, SerializedListEventOptions as _n, VaultByokKeyVerificationCompletedEvent as _o, CreateOrganizationOptions as _r, SerializedCreatedApiKey as _s, AuditLogActor as _t, OauthTokensResponse as _u, PublicWorkOS as a, GroupUpdatedEventResponse as aa, PasswordReset as ac, BaseCreateGroupRoleAssignmentOptions as ad, SerializedUpdateAuthorizationResourceOptions as af, AuthenticationSSOFailedEventResponse as ai, AuthenticationFactorResponse as al, SerializedGetAccessTokenFailureResponse as an, RoleUpdatedEventResponse as ao, UserRegistrationActionResponseData as ar, FlagPollEntry as as, DecryptDataKeyResponse as at, AuthenticateWithCodeOptions as au, NotFoundException as b, OrganizationDomainCreatedEvent as ba, ListSessionsOptions as bc, SerializedRemoveRoleOptions as bd, SerializedCreateOrganizationRoleOptions as bf, DsyncGroupDeletedEvent as bi, AuthenticateWithSessionCookieFailureReason as bl, ApplicationCredentialsListItem as bn, VaultDataCreatedEventResponse as bo, DomainData as br, SerializedCreateOrganizationApiKeyOptions as bs, CreateAuditLogEventRequestOptions as bt, GetProfileAndTokenOptions as bu, PortalLinkResponseWire as c, InvitationCreatedEvent as ca, PasswordResetResponse as cc, CreateGroupRoleAssignmentOptionsWithResourceExternalId as cd, SerializedUpdatePermissionOptions as cf, ConnectionActivatedEvent as ci, Totp as cl, SerializedGetAccessTokenSuccessResponse as cn, SessionRevokedEvent as co, UserData as cr, FeatureFlag as cs, WidgetSessionTokenResponseWire as ct, AuthenticateWithSessionOptions as cu, IntentOptions as d, InvitationResentEventResponse as da, MagicAuth as dc, GetGroupRoleAssignmentOptions as dd, SerializedCreatePermissionOptions as df, ConnectionDeactivatedEventResponse as di, TotpWithSecretsResponse as dl, SendSessionResponse as dn, UserCreatedEvent as do, SerializedUpdateOrganizationOptions as dr, AddFlagTargetOptions as ds, FeatureFlagsRuntimeClient as dt, WithResolvedClientId as du, GroupMemberEventData as ea, SerializedResetPasswordOptions as ec, RemoveGroupRoleAssignmentsOptionsForOrganization as ed, AuthorizationResourceResponse as ef, AuthenticationPasswordSucceededEvent as ei, PKCEAuthorizationURLResult as el, RadarStandaloneAssessRequestAuthMethod as en, RoleCreatedEvent as eo, PKCE as er, RuntimeClientLogger as es, ReadObjectOptions as et, AuthenticateWithEmailVerificationOptions as eu, IntentOptionsResponse as f, InvitationRevokedEvent as fa, MagicAuthEvent as fc, ListGroupRoleAssignmentsOptions as fd, Permission as ff, ConnectionDeletedEvent as fi, AuthenticationEvent as fl, CreatePasswordlessSessionOptions as fn, UserCreatedEventResponse as fo, UpdateOrganizationOptions as fr, SerializedValidateApiKeyResponse as fs, CookieSession as ft, ProfileAndToken as fu, UnauthorizedException as g, OrganizationCreatedEvent as ga, Locale as gc, BaseRemoveRoleOptions as gd, SetOrganizationRolePermissionsOptions as gf, DsyncDeletedEvent as gi, AuthenticateUserWithTotpCredentials as gl, ListEventOptions as gn, UserUpdatedEventResponse as go, ListOrganizationFeatureFlagsOptions as gr, CreatedApiKey as gs, SerializedCreateAuditLogSchemaOptions as gt, OauthTokens as gu, UnprocessableEntityException as h, MagicAuthCreatedEventResponse as ha, LogoutURLOptions as hc, RemoveRoleAssignmentOptions as hd, AddOrganizationRolePermissionOptions as hf, DsyncActivatedEventResponse as hi, AuthenticationEventSsoResponse as hl, PasswordlessSessionResponse as hn, UserUpdatedEvent as ho, ListOrganizationsOptions as hr, ListOrganizationApiKeysOptions as hs, CreateAuditLogSchemaResponse as ht, ProfileResponse as hu, PublicUserManagement as i, GroupUpdatedEvent as ia, RefreshSessionResponse as ic, RemoveGroupRoleAssignmentOptions as id, SerializedCreateAuthorizationResourceOptions as if, AuthenticationSSOFailedEvent as ii, AuthenticationFactor as il, GetAccessTokenSuccessResponse as in, RoleUpdatedEvent as io, ResponsePayload as ir, FlagChange as is, DecryptDataKeyOptions as it, AuthenticateUserWithCodeCredentials as iu, Webhooks as j, OrganizationMembershipCreatedResponse as ja, ListInvitationsOptions as jc, RoleAssignment as jd, EnvironmentRoleResponse as jf, DsyncUserDeletedEventResponse as ji, Impersonator as jl, ExternalAuthCompleteResponseWire as jn, VaultKekCreatedEvent as jo, GenerateLinkIntent as jr, SerializedVerifyEmailOptions as js, VerifyResponse as jt, DirectoryUserWithGroups as ju, WorkOSErrorData as k, OrganizationDomainVerifiedEventResponse as ka, OrganizationMembershipResponse as kc, ListRoleAssignmentsOptions as kd, EnvironmentRoleList as kf, DsyncUserCreatedEventResponse as ki, User as kl, ConnectApplicationRedirectUriResponse as kn, VaultDekReadEvent as ko, ListResponse as kr, CreateOrganizationDomainOptions as ks, AuditLogExportOptions as kt, DirectoryUser as ku, GenerateLink as l, InvitationCreatedEventResponse as la, CreateMagicAuthResponse as lc, CreateGroupRoleAssignmentOptionsWithResourceId as ld, UpdatePermissionOptions as lf, ConnectionActivatedEventResponse as li, TotpResponse as ll, AccessToken as ln, SessionRevokedEventResponse as lo, UserDataPayload as lr, FeatureFlagResponse as ls, CreateTokenOptions as lt, SerializedAuthenticatePublicClientBase as lu, SSOIntentOptionsResponse as m, MagicAuthCreatedEvent as ma, MagicAuthResponse as mc, GroupRoleAssignmentResponse as md, RemoveOrganizationRolePermissionOptions as mf, DsyncActivatedEvent as mi, AuthenticationEventSso as ml, PasswordlessSession as mn, UserDeletedEventResponse as mo, OrganizationResponse as mr, ValidateApiKeyResponse as ms, CreateAuditLogSchemaRequestOptions as mt, Profile as mu, PublicClientOptions as n, GroupMemberRemovedEvent as na, SerializedResendInvitationOptions as nc, RemoveGroupRoleAssignmentsOptionsWithResourceId as nd, CreateOptionsWithParentExternalId as nf, AuthenticationRadarRiskDetectedEvent as ni, AuthenticationRadarRiskDetectedEventData as nl, GetAccessTokenOptions as nn, RoleDeletedEvent as no, Actions as nr, RemoveFlagTargetOptions as ns, CreateObjectEntity as nt, AuthenticateWithCodeAndVerifierOptions as nu, createWorkOS as o, InvitationAcceptedEvent as oa, PasswordResetEvent as oc, CreateGroupRoleAssignmentOptions as od, UpdateAuthorizationResourceOptions as of, AuthenticationSSOSucceededEvent as oi, AuthenticationFactorWithSecrets as ol, SerializedGetAccessTokenOptions as on, SessionCreatedEvent as oo, ActionContext as or, FlagPollResponse as os, CreateDataKeyOptions as ot, SerializedAuthenticateWithCodeOptions as ou, SSOIntentOptions as p, InvitationRevokedEventResponse as pa, MagicAuthEventResponse as pc, GroupRoleAssignment as pd, PermissionResponse as pf, ConnectionDeletedEventResponse as pi, AuthenticationEventResponse as pl, SerializedCreatePasswordlessSessionOptions as pn, UserDeletedEvent as po, Organization as pr, ValidateApiKeyOptions as ps, CreateAuditLogSchemaOptions as pt, ProfileAndTokenResponse as pu, Actor as q, PasswordResetSucceededEventResponse as qa, SerializedCreateUserOptions as qc, DeleteAuthorizationResourceOptions as qd, HttpClientInterface as qf, FlagUpdatedEventResponse as qi, AuthenticateUserWithRadarEmailChallengeCredentials as ql, UserConsentOption as qn, GetGroupOptions as qo, AuthenticationOAuthSucceededEventResponse as qr, SerializedSendRadarSmsChallengeOptions as qs, RadarStandaloneResponseWire as qt, GroupRoleAssignmentEntryWithResourceExternalId as qu, PublicSSO as r, GroupMemberRemovedEventResponse as ra, RefreshSessionFailureReason as rc, SerializedRemoveGroupRoleAssignmentsOptions as rd, CreateOptionsWithParentResourceId as rf, AuthenticationRadarRiskDetectedEventResponse as ri, AuthenticationRadarRiskDetectedEventResponseData as rl, GetAccessTokenResponse as rn, RoleDeletedEventResponse as ro, AuthenticationActionResponseData as rr, ListFeatureFlagsOptions as rs, CreateObjectOptions as rt, SerializedAuthenticateWithCodeAndVerifierOptions as ru, PortalLinkResponse as s, InvitationAcceptedEventResponse as sa, PasswordResetEventResponse as sc, CreateGroupRoleAssignmentOptionsForOrganization as sd, ListPermissionsOptions as sf, AuthenticationSSOSucceededEventResponse as si, AuthenticationFactorWithSecretsResponse as sl, SerializedGetAccessTokenResponse as sn, SessionCreatedEventResponse as so, ActionPayload as sr, FlagTarget as ss, WidgetSessionTokenResponse as st, AuthenticateWithOptionsBase as su, ConfidentialClientOptions as t, GroupMemberEventResponseData as ta, ResendInvitationOptions as tc, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as td, CreateAuthorizationResourceOptions as tf, AuthenticationPasswordSucceededEventResponse as ti, UserManagementAuthorizationURLOptions as tl, GetAccessTokenFailureResponse as tn, RoleCreatedEventResponse as to, PKCEPair as tr, RuntimeClientOptions as ts, ReadObjectResponse as tt, SerializedAuthenticateWithEmailVerificationOptions as tu, GenerateLinkResponse as u, InvitationResentEvent as ua, CreateMagicAuthResponseResponse as uc, SerializedCreateGroupRoleAssignmentOptions as ud, CreatePermissionOptions as uf, ConnectionDeactivatedEvent as ui, TotpWithSecrets as ul, SerializedAccessToken as un, UnknownEvent as uo, UserRegistrationActionPayload as ur, EvaluationContext as us, WidgetSessionTokenScopes as ut, SerializedAuthenticateWithOptionsBase as uu, RateLimitExceededException as v, OrganizationDeletedEvent as va, SerializedListUsersOptions as vc, RemoveRoleOptionsWithResourceExternalId as vd, UpdateOrganizationRoleOptions as vf, DsyncGroupCreatedEvent as vi, SerializedAuthenticateWithTotpOptions as vl, NewConnectApplicationSecret as vn, VaultByokKeyVerificationCompletedEventResponse as vo, CreateOrganizationRequestOptions as vr, CreateOrganizationApiKeyOptions as vs, AuditLogTarget as vt, ListConnectionsOptions as vu, AuthenticationErrorCode as w, OrganizationDomainUpdatedEvent as wa, AuthorizationOrganizationMembership as wc, BaseAssignRoleOptions as wd, SerializedUpdateEnvironmentRoleOptions as wf, DsyncGroupUserAddedEvent as wi, UserManagementAccessToken as wl, ConnectApplicationM2MResponse as wn, VaultDataReadEventResponse as wo, UnprocessableEntityError as wr, OrganizationDomainVerificationFailedResponse as ws, AuditLogSchemaMetadata as wt, ConnectionResponse as wu, NoApiKeyProvidedException as x, OrganizationDomainCreatedEventResponse as xa, SerializedListSessionsOptions as xc, AssignRoleOptions as xd, OrganizationRole as xf, DsyncGroupDeletedEventResponse as xi, AuthenticateWithSessionCookieOptions as xl, ApplicationCredentialsListItemResponse as xn, VaultDataDeletedEvent as xo, DomainDataState as xr, ApiKey as xs, SerializedCreateAuditLogEventOptions as xt, GetProfileOptions as xu, OauthException as y, OrganizationDeletedResponse as ya, ListUserFeatureFlagsOptions as yc, RemoveRoleOptionsWithResourceId as yd, CreateOrganizationRoleOptions as yf, DsyncGroupCreatedEventResponse as yi, AuthenticateWithSessionCookieFailedResponse as yl, NewConnectApplicationSecretResponse as yn, VaultDataCreatedEvent as yo, SerializedCreateOrganizationOptions as yr, CreateOrganizationApiKeyRequestOptions as ys, CreateAuditLogEventOptions as yt, SerializedListConnectionsOptions as yu, ObjectSummary as z, OrganizationRoleDeletedEventResponse as za, Identity as zc, ListResourcesForMembershipOptionsWithParentExternalId as zd, Directory as zf, EventResponse as zi, AuthenticateWithPasswordOptions as zl, CreateM2MApplication as zn, KeyContext as zo, AuthenticationMagicAuthFailedEventResponse as zr, AuthMethod as zs, SmsResponse as zt, RoleEventResponse as zu };
-//# sourceMappingURL=factory-nPldaSjn.d.mts.map
+export { ReadObjectMetadataResponse as $, FlagDeletedEvent as $a, SessionStatus as $c, ListEffectivePermissionsByExternalIdOptions as $d, ListResourcesForMembershipOptionsWithParentId as $f, AuthenticationMfaSucceededEvent as $i, EmailVerification as $l, DataIntegrationCredentialsDtoResponse as $n, OrganizationUpdatedEvent as $o, DirectoryResponse as $p, ValidateAgentApiKeyOptions as $r, RemoveGroupOrganizationMembershipOptions as $s, RadarStandaloneAssessRequestAction as $t, AuthenticateWithOrganizationSelectionOptions as $u, ApiKeyRequiredException as A, DsyncGroupCreatedEventResponse as Aa, CreateOrganizationApiKeyRequestOptions as Ac, SerializedListConnectionsOptions as Ad, RemoveRoleOptionsWithResourceId as Af, SerializedCreateOrganizationOptions as Ai, ListUserFeatureFlagsOptions as Al, DataIntegrationCredentialResponse as An, OrganizationDeletedResponse as Ao, SerializedUpdateOrganizationRoleOptions as Ap, CreateM2MApplicationResponse as Ar, VaultDataCreatedEvent as As, SerializedAuditLogExportOptions as At, AuthenticateWithSessionCookieFailedResponse as Au, ObjectSummaryResponse as B, DsyncUserCreatedEventResponse as Ba, CreateOrganizationDomainOptions as Bc, DirectoryUser as Bd, ListRoleAssignmentsOptions as Bf, ListResponse as Bi, OrganizationMembershipResponse as Bl, AuthorizeDataIntegrationOptions as Bn, OrganizationDomainVerifiedEventResponse as Bo, SerializedCreateEnvironmentRoleOptions as Bp, UserConsentOptionChoiceResponse as Br, VaultDekReadEvent as Bs, EnrollFactorOptions as Bt, User as Bu, BadRequestException as C, ConnectionDeletedEvent as Ca, SerializedValidateApiKeyResponse as Cc, ProfileAndToken as Cd, ListGroupRoleAssignmentsOptions as Cf, UpdateOrganizationOptions as Ci, MagicAuthEvent as Cl, DataIntegration as Cn, InvitationRevokedEvent as Co, CreatePermissionOptions as Cp, CreateApplicationClientSecretOptions as Cr, UserCreatedEventResponse as Cs, AuditLogSchema as Ct, AuthenticationEvent as Cu, isAuthenticationErrorData as D, DsyncDeletedEvent as Da, CreatedApiKey as Dc, OauthTokens as Dd, BaseRemoveRoleOptions as Df, ListOrganizationFeatureFlagsOptions as Di, Locale as Dl, DataIntegrationCustomProviderResponse as Dn, OrganizationCreatedEvent as Do, RemoveOrganizationRolePermissionOptions as Dp, GetApplicationOptions as Dr, UserUpdatedEventResponse as Ds, AuditLogExport as Dt, AuthenticateUserWithTotpCredentials as Du, AuthenticationException as E, DsyncActivatedEventResponse as Ea, ListOrganizationApiKeysOptions as Ec, ProfileResponse as Ed, RemoveRoleAssignmentOptions as Ef, ListOrganizationsOptions as Ei, LogoutURLOptions as El, DataIntegrationCustomProvider as En, MagicAuthCreatedEventResponse as Eo, PermissionResponse as Ep, UpdateApplicationOptions as Er, UserUpdatedEvent as Es, AuditLogTargetSchema as Et, AuthenticationEventSsoResponse as Eu, UpdateWebhookEndpointEvents as F, DsyncGroupUserAddedEvent as Fa, OrganizationDomainVerificationFailedResponse as Fc, ConnectionResponse as Fd, BaseAssignRoleOptions as Ff, UnprocessableEntityError as Fi, AuthorizationOrganizationMembership as Fl, CreateUserConnectedAccountOptions as Fn, OrganizationDomainUpdatedEvent as Fo, AddEnvironmentRolePermissionOptions as Fp, ListApplicationsOptions as Fr, VaultDataReadEventResponse as Fs, FactorResponse as Ft, UserManagementAccessToken as Fu, ObjectMetadata as G, EmailVerificationCreatedEvent as Ga, UpdateUserPasswordOptions as Gc, OrganizationRoleEvent as Gd, RoleAssignmentResponse as Gf, ApiKeyRevokedEvent as Gi, ListAuthFactorsOptions as Gl, UpdateCustomProviderDefinitionResponse as Gn, OrganizationMembershipUpdated as Go, ListDirectoryUsersOptions as Gp, AgentCredentialType as Gr, VaultMetadataReadEventResponse as Gs, RadarListEntryAlreadyPresentResponseWire as Gt, SerializedAuthenticateWithRefreshTokenPublicClientOptions as Gu, ObjectVersionResponse as H, DsyncUserDeletedEventResponse as Ha, SerializedVerifyEmailOptions as Hc, DirectoryUserWithGroups as Hd, RoleAssignment as Hf, GenerateLinkIntent as Hi, ListInvitationsOptions as Hl, DeleteDataIntegrationOptions as Hn, OrganizationMembershipCreatedResponse as Ho, EnvironmentRoleList as Hp, UserObjectResponse as Hr, VaultKekCreatedEvent as Hs, ChallengeResponse as Ht, Impersonator as Hu, UpdateWebhookEndpointStatus as I, DsyncGroupUserAddedEventResponse as Ia, OrganizationDomain as Ic, ConnectionType as Id, SerializedAssignRoleOptions as If, PutOptions as Ii, AuthorizationOrganizationMembershipResponse as Il, ConnectedAccountState as In, OrganizationDomainUpdatedEventResponse as Io, SetEnvironmentRolePermissionsOptions as Ip, CompleteOAuth2Options as Ir, VaultDataUpdatedEvent as Is, FactorWithSecrets as It, AuthenticationResponse as Iu, ActorResponse as J, EventBase as Ja, SerializedUpdateOrganizationMembershipOptions as Jc, Role as Jd, RoleAssignmentSourceResponse as Jf, AuthenticationEmailVerificationSucceededEventResponse as Ji, InvitationEventResponse as Jl, CreateDataIntegrationOptions as Jn, OrganizationRoleCreatedEventResponse as Jo, SerializedListDirectoriesOptions as Jp, SerializedAgentAccessTokenClaims as Jr, DataKey as Js, RadarStandaloneResponseBlocklistType as Jt, SerializedAuthenticateWithRefreshTokenOptions as Ju, ObjectMetadataResponse as K, EmailVerificationCreatedEventResponse as Ka, SerializedUpdateUserOptions as Kc, OrganizationRoleEventResponse as Kd, RoleAssignmentRole as Kf, ApiKeyRevokedEventResponse as Ki, Invitation as Kl, UpdateCustomProviderDefinitionAuthenticateVia as Kn, OrganizationMembershipUpdatedResponse as Ko, ListDirectoryGroupsOptions as Kp, AgentCredentialValidation as Kr, VaultNamesListedEvent as Ks, RadarStandaloneResponse as Kt, AuthenticateUserWithRefreshTokenCredentials as Ku, CreateWebhookEndpointEvents as L, DsyncGroupUserRemovedEvent as La, OrganizationDomainResponse as Lc, SSOAuthorizationURLOptions as Ld, ListRoleAssignmentsForResourceByExternalIdOptions as Lf, PostOptions as Li, BaseOrganizationMembership as Ll, GetUserConnectedAccountOptions as Ln, OrganizationDomainVerificationFailedEvent as Lo, SerializedUpdateEnvironmentRoleOptions as Lp, UserConsentOption as Lr, VaultDataUpdatedEventResponse as Ls, FactorWithSecretsResponse as Lt, AuthenticationResponseResponse as Lu, WebhookEndpoint as M, DsyncGroupDeletedEventResponse as Ma, ApiKey as Mc, GetProfileOptions as Md, AssignRoleOptions as Mf, DomainDataState as Mi, SerializedListSessionsOptions as Ml, ListUserDataProvidersOptions as Mn, OrganizationDomainCreatedEventResponse as Mo, CreateOrganizationRoleOptions as Mp, CreateOAuthApplicationResponse as Mr, VaultDataDeletedEvent as Ms, VerifyResponseResponse as Mt, AuthenticateWithSessionCookieOptions as Mu, WebhookEndpointResponse as N, DsyncGroupUpdatedEvent as Na, SerializedApiKey as Nc, Connection as Nd, AssignRoleOptionsWithResourceExternalId as Nf, WorkOSResponseError as Ni, ListOrganizationMembershipsOptions as Nl, DeleteUserConnectedAccountOptions as Nn, OrganizationDomainDeletedEvent as No, SerializedCreateOrganizationRoleOptions as Np, RedirectUriInput as Nr, VaultDataDeletedEventResponse as Ns, VerifyChallengeOptions as Nt, AuthenticateWithSessionCookieSuccessResponse as Nu, GenericServerException as O, DsyncDeletedEventResponse as Oa, SerializedCreatedApiKey as Oc, OauthTokensResponse as Od, RemoveRoleOptions as Of, CreateOrganizationOptions as Oi, ListUsersOptions as Ol, DataIntegrationCustomProviderAuthenticateVia as On, OrganizationCreatedResponse as Oo, AddOrganizationRolePermissionOptions as Op, CreateApplicationOptions as Or, VaultByokKeyVerificationCompletedEvent as Os, AuditLogExportResponse as Ot, AuthenticateWithTotpOptions as Ou, WebhookEndpointStatus as P, DsyncGroupUpdatedEventResponse as Pa, OrganizationDomainVerificationFailed as Pc, ConnectionDomain as Pd, AssignRoleOptionsWithResourceId as Pf, WorkOSOptions as Pi, SerializedListOrganizationMembershipsOptions as Pl, UpdateUserConnectedAccountOptions as Pn, OrganizationDomainDeletedEventResponse as Po, OrganizationRole as Pp, RedirectUriInputResponse as Pr, VaultDataReadEvent as Ps, Factor as Pt, SessionCookieData as Pu, UpdateObjectOptions as Q, FlagCreatedEventResponse as Qa, SessionResponse as Qc, RoleResponse as Qd, ListResourcesForMembershipOptionsWithParentExternalId as Qf, AuthenticationMagicAuthSucceededEventResponse as Qi, SerializedEnrollUserInMfaFactorOptions as Ql, DataIntegrationCredentialsDto as Qn, OrganizationRoleUpdatedEventResponse as Qo, Directory as Qp, ValidateAgentAccessTokenOptions as Qr, UpdateGroupOptions as Qs, RadarListType as Qt, AuthenticateUserWithOrganizationSelectionCredentials as Qu, WorkOS as R, DsyncGroupUserRemovedEventResponse as Ra, OrganizationDomainState as Rc, SSOPKCEAuthorizationURLResult as Rd, ListRoleAssignmentsForResourceOptions as Rf, PatchOptions as Ri, BaseOrganizationMembershipResponse as Rl, GetAccessTokenOptions as Rn, OrganizationDomainVerificationFailedEventResponse as Ro, UpdateEnvironmentRoleOptions as Rp, UserConsentOptionResponse as Rr, VaultDekDecryptedEvent as Rs, Sms as Rt, CreateUserResponse as Ru, ConflictException as S, ConnectionDeactivatedEventResponse as Sa, AddFlagTargetOptions as Sc, WithResolvedClientId as Sd, GetGroupRoleAssignmentOptions as Sf, SerializedUpdateOrganizationOptions as Si, MagicAuth as Sl, ConnectedAccountAuthMethod as Sn, InvitationResentEventResponse as So, UpdatePermissionOptions as Sp, DeleteClientSecretOptions as Sr, UserCreatedEvent as Ss, AuditLogActorSchema as St, TotpWithSecretsResponse as Su, AuthenticationErrorData as T, DsyncActivatedEvent as Ta, ValidateApiKeyResponse as Tc, Profile as Td, GroupRoleAssignmentResponse as Tf, OrganizationResponse as Ti, MagicAuthResponse as Tl, DataIntegrationState as Tn, MagicAuthCreatedEvent as To, Permission as Tp, DeleteApplicationOptions as Tr, UserDeletedEventResponse as Ts, AuditLogSchemaResponse as Tt, AuthenticationEventSso as Tu, VaultObject as U, DsyncUserUpdatedEvent as Ua, VerifyEmailOptions as Uc, DirectoryUserWithGroupsResponse as Ud, RoleAssignmentResource as Uf, ApiKeyCreatedEvent as Ui, SerializedListInvitationsOptions as Ul, UpdateDataIntegrationOptions as Un, OrganizationMembershipDeleted as Uo, EnvironmentRoleListResponse as Up, AutoPaginatable as Ur, VaultKekCreatedEventResponse as Us, ChallengeFactorOptions as Ut, ImpersonatorResponse as Uu, ObjectVersion as V, DsyncUserDeletedEvent as Va, SerializedCreateOrganizationDomainOptions as Vc, DirectoryUserResponse as Vd, SerializedListRoleAssignmentsOptions as Vf, GetOptions as Vi, OrganizationMembershipStatus as Vl, UpdateDataIntegrationApiKeyOptions as Vn, OrganizationMembershipCreated as Vo, EnvironmentRole as Vp, UserObject as Vr, VaultDekReadEventResponse as Vs, Challenge as Vt, UserResponse as Vu, VaultObjectResponse as W, DsyncUserUpdatedEventResponse as Wa, SerializedUpdateUserPasswordOptions as Wc, ListOrganizationRolesResponse as Wd, RoleAssignmentResourceResponse as Wf, ApiKeyCreatedEventResponse as Wi, ListGroupsForOrganizationMembershipOptions as Wl, UpdateCustomProviderDefinition as Wn, OrganizationMembershipDeletedResponse as Wo, EnvironmentRoleResponse as Wp, AgentAccessTokenClaims as Wr, VaultMetadataReadEvent as Ws, RadarListEntryAlreadyPresentResponse as Wt, AuthenticateWithRefreshTokenPublicClientOptions as Wu, CreateDataKeyResponseWire as X, EventResponse as Xa, AuthMethod as Xc, RoleEventResponse as Xd, ListMembershipsForResourceOptions as Xf, AuthenticationMagicAuthFailedEventResponse as Xi, Identity as Xl, CustomProviderDefinitionResponse as Xn, OrganizationRoleDeletedEventResponse as Xo, DirectoryGroup as Xp, SerializedValidateAgentCredentialOptions as Xr, KeyContext as Xs, RadarStandaloneResponseVerdict as Xt, AuthenticateWithPasswordOptions as Xu, CreateDataKeyResponse as Y, EventName as Ya, UpdateOrganizationMembershipOptions as Yc, RoleEvent as Yd, ListMembershipsForResourceByExternalIdOptions as Yf, AuthenticationMagicAuthFailedEvent as Yi, InvitationResponse as Yl, CustomProviderDefinition as Yn, OrganizationRoleDeletedEvent as Yo, PaginationOptions as Yp, SerializedAgentCredentialValidation as Yr, DataKeyPair as Ys, RadarStandaloneResponseControl as Yt, AuthenticateUserWithPasswordCredentials as Yu, UpdateObjectEntity as Z, FlagCreatedEvent as Za, Session as Zc, RoleList as Zd, ListResourcesForMembershipOptions as Zf, AuthenticationMagicAuthSucceededEvent as Zi, EnrollAuthFactorOptions as Zl, CustomProviderDefinitionAuthenticateVia as Zn, OrganizationRoleUpdatedEvent as Zo, DirectoryGroupResponse as Zp, ValidAgentCredential as Zr, SerializedUpdateGroupOptions as Zs, RadarListAction as Zt, SerializedAuthenticateWithPasswordOptions as Zu, SignatureVerificationException as _, AuthenticationSSOSucceededEvent as _a, FlagPollResponse as _c, SerializedAuthenticateWithCodeOptions as _d, CreateGroupRoleAssignmentOptions as _f, ActionContext as _i, PasswordResetEvent as _l, DataIntegrationCredentialsResponseCredentialResponse as _n, InvitationAcceptedEvent as _o, SerializedCreateAuthorizationResourceOptions as _p, ConnectApplicationResponse as _r, SessionCreatedEvent as _s, AuditLogActor as _t, AuthenticationFactorWithSecrets as _u, PublicWorkOS as a, AuthenticationPasskeyFailedEvent as aa, DeleteGroupOptions as ac, AuthenticateWithRadarEmailChallengeOptions as ad, GroupRoleAssignmentEntryWithResourceId as af, AgentRegistrationKind as ai, SendInvitationOptions as al, HttpClient as am, DataIntegrationsListResponseDataOwnership as an, GroupCreatedEvent as ao, SerializedAuthorizationCheckOptions as ap, PasswordlessSessionResponse as ar, PermissionCreatedEvent as as, DecryptDataKeyResponse as at, CreatePasswordResetOptions as au, NotFoundException as b, ConnectionActivatedEventResponse as ba, FeatureFlagResponse as bc, SerializedAuthenticatePublicClientBase as bd, CreateGroupRoleAssignmentOptionsWithResourceId as bf, UserDataPayload as bi, CreateMagicAuthResponse as bl, ConnectedAccount as bn, InvitationCreatedEventResponse as bo, ListPermissionsOptions as bp, ExternalAuthCompleteResponse as br, SessionRevokedEventResponse as bs, CreateAuditLogEventRequestOptions as bt, TotpResponse as bu, PortalLinkResponseWire as c, AuthenticationPasskeySucceededEventResponse as ca, AddGroupOrganizationMembershipOptions as cc, AuthenticateWithMagicAuthOptions as cd, SerializedReplaceGroupRoleAssignmentsOptions as cf, SerializedAgentRegistration as ci, SerializedRevokeSessionOptions as cl, RequestHeaders as cm, DataIntegrationsListResponseDataConnectedAccountResponse as cn, GroupDeletedEventResponse as co, UpdateAuthorizationResourceByExternalIdOptions as cp, NewConnectApplicationSecret as cr, PermissionDeletedEventResponse as cs, WidgetSessionTokenResponseWire as ct, SerializedCreateOrganizationMembershipOptions as cu, IntentOptions as d, AuthenticationPasswordSucceededEvent as da, RuntimeClientLogger as dc, AuthenticateWithEmailVerificationOptions as dd, RemoveGroupRoleAssignmentsOptionsForOrganization as df, PKCE as di, SerializedResetPasswordOptions as dl, ResponseHeaders as dm, DataIntegrationAccessTokenResponse as dn, GroupMemberEventData as do, SerializedListAuthorizationResourcesOptions as dp, ApplicationCredentialsListItemResponse as dr, RoleCreatedEvent as ds, FeatureFlagsRuntimeClient as dt, PKCEAuthorizationURLResult as du, AuthenticationMfaSucceededEventResponse as ea, ListGroupsOptions as ec, SerializedAuthenticateWithOrganizationSelectionOptions as ed, ListEffectivePermissionsOptions as ef, ValidateAgentCredentialOptions as ei, SendVerificationEmailOptions as el, DirectoryState as em, RadarStandaloneAssessRequestAuthMethod as en, FlagDeletedEventResponse as eo, SerializedListResourcesForMembershipOptions as ep, DataIntegrationCredentialsType as er, OrganizationUpdatedResponse as es, ReadObjectOptions as et, EmailVerificationEvent as eu, IntentOptionsResponse as f, AuthenticationPasswordSucceededEventResponse as fa, RuntimeClientOptions as fc, SerializedAuthenticateWithEmailVerificationOptions as fd, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as ff, PKCEPair as fi, ResendInvitationOptions as fl, CryptoProvider as fm, DataIntegrationAccessTokenResponseWire as fn, GroupMemberEventResponseData as fo, AuthorizationResource as fp, ConnectApplication as fr, RoleCreatedEventResponse as fs, CookieSession as ft, UserManagementAuthorizationURLOptions as fu, UnauthorizedException as g, AuthenticationSSOFailedEventResponse as ga, FlagPollEntry as gc, AuthenticateWithCodeOptions as gd, BaseCreateGroupRoleAssignmentOptions as gf, UserRegistrationActionResponseData as gi, PasswordReset as gl, DataIntegrationCredentialsResponseCredential as gn, GroupUpdatedEventResponse as go, CreateOptionsWithParentResourceId as gp, ConnectApplicationOAuthResponse as gr, RoleUpdatedEventResponse as gs, SerializedCreateAuditLogSchemaOptions as gt, AuthenticationFactorResponse as gu, UnprocessableEntityException as h, AuthenticationSSOFailedEvent as ha, FlagChange as hc, AuthenticateUserWithCodeCredentials as hd, RemoveGroupRoleAssignmentOptions as hf, ResponsePayload as hi, RefreshSessionResponse as hl, DataIntegrationCredentialsResponseError as hn, GroupUpdatedEvent as ho, CreateOptionsWithParentExternalId as hp, ConnectApplicationOAuth as hr, RoleUpdatedEvent as hs, CreateAuditLogSchemaResponse as ht, AuthenticationFactor as hu, PublicUserManagement as i, AuthenticationOAuthSucceededEventResponse as ia, GetGroupOptions as ic, AuthenticateUserWithRadarEmailChallengeCredentials as id, GroupRoleAssignmentEntryWithResourceExternalId as if, AgentRegistrationClaimCompletion as ii, SerializedSendRadarSmsChallengeOptions as il, EventDirectoryResponse as im, DataIntegrationsListResponseDataResponse as in, FlagUpdatedEventResponse as io, AuthorizationCheckResult as ip, PasswordlessSession as ir, PasswordResetSucceededEventResponse as is, DecryptDataKeyOptions as it, SerializedCreateUserOptions as iu, Webhooks as j, DsyncGroupDeletedEvent as ja, SerializedCreateOrganizationApiKeyOptions as jc, GetProfileAndTokenOptions as jd, SerializedRemoveRoleOptions as jf, DomainData as ji, ListSessionsOptions as jl, DataIntegrationCredentialType as jn, OrganizationDomainCreatedEvent as jo, UpdateOrganizationRoleOptions as jp, CreateOAuthApplication as jr, VaultDataCreatedEventResponse as js, VerifyResponse as jt, AuthenticateWithSessionCookieFailureReason as ju, WorkOSErrorData as k, DsyncGroupCreatedEvent as ka, CreateOrganizationApiKeyOptions as kc, ListConnectionsOptions as kd, RemoveRoleOptionsWithResourceExternalId as kf, CreateOrganizationRequestOptions as ki, SerializedListUsersOptions as kl, DataIntegrationCredential as kn, OrganizationDeletedEvent as ko, SetOrganizationRolePermissionsOptions as kp, CreateM2MApplication as kr, VaultByokKeyVerificationCompletedEventResponse as ks, AuditLogExportOptions as kt, SerializedAuthenticateWithTotpOptions as ku, GenerateLink as l, AuthenticationPasswordFailedEvent as la, SerializedAddGroupOrganizationMembershipOptions as lc, SerializedAuthenticateWithMagicAuthOptions as ld, BaseRemoveGroupRoleAssignmentsOptions as lf, SerializedAgentRegistrationClaim as li, serializeRevokeSessionOptions as ll, RequestOptions as lm, DataIntegrationsListResponseDataConnectedAccountState as ln, GroupMemberAddedEvent as lo, GetAuthorizationResourceByExternalIdOptions as lp, NewConnectApplicationSecretResponse as lr, PermissionUpdatedEvent as ls, CreateTokenOptions as lt, CreateMagicAuthOptions as lu, SSOIntentOptionsResponse as m, AuthenticationRadarRiskDetectedEventResponse as ma, ListFeatureFlagsOptions as mc, SerializedAuthenticateWithCodeAndVerifierOptions as md, SerializedRemoveGroupRoleAssignmentsOptions as mf, AuthenticationActionResponseData as mi, RefreshSessionFailureReason as ml, DataIntegrationAccessTokenResponseAccessTokenResponse as mn, GroupMemberRemovedEventResponse as mo, CreateAuthorizationResourceOptions as mp, ConnectApplicationM2MResponse as mr, RoleDeletedEventResponse as ms, CreateAuditLogSchemaRequestOptions as mt, AuthenticationRadarRiskDetectedEventResponseData as mu, PublicClientOptions as n, AuthenticationOAuthFailedEventResponse as na, Group as nc, AuthenticateWithRadarSmsChallengeOptions as nd, GroupRoleAssignmentEntry as nf, AgentRegistration as ni, SendRadarSmsChallengeResponse as nl, DirectoryType as nm, DataIntegrationsListResponseWire as nn, FlagRuleUpdatedEventResponse as no, AuthorizationCheckOptionsWithResourceExternalId as np, CreatePasswordlessSessionOptions as nr, PasswordResetCreatedEventResponse as ns, CreateObjectEntity as nt, EmailVerificationResponse as nu, createWorkOS as o, AuthenticationPasskeyFailedEventResponse as oa, CreateGroupOptions as oc, SerializedAuthenticateWithRadarEmailChallengeOptions as od, ReplaceGroupRoleAssignmentsOptions as of, AgentRegistrationStatus as oi, SerializedSendInvitationOptions as ol, HttpClientInterface as om, DataIntegrationsListResponseDataAuthMethods as on, GroupCreatedEventResponse as oo, DeleteAuthorizationResourceOptions as op, ListEventOptions as or, PermissionCreatedEventResponse as os, CreateDataKeyOptions as ot, SerializedCreatePasswordResetOptions as ou, SSOIntentOptions as p, AuthenticationRadarRiskDetectedEvent as pa, RemoveFlagTargetOptions as pc, AuthenticateWithCodeAndVerifierOptions as pd, RemoveGroupRoleAssignmentsOptionsWithResourceId as pf, Actions as pi, SerializedResendInvitationOptions as pl, DataIntegrationAccessTokenResponseAccessToken as pn, GroupMemberRemovedEvent as po, AuthorizationResourceResponse as pp, ConnectApplicationM2M as pr, RoleDeletedEvent as ps, CreateAuditLogSchemaOptions as pt, AuthenticationRadarRiskDetectedEventData as pu, Actor as q, Event as qa, UpdateUserOptions as qc, OrganizationRoleResponse as qd, RoleAssignmentSource as qf, AuthenticationEmailVerificationSucceededEvent as qi, InvitationEvent as ql, GetDataIntegrationOptions as qn, OrganizationRoleCreatedEvent as qo, ListDirectoriesOptions as qp, InvalidAgentCredential as qr, VaultNamesListedEventResponse as qs, RadarStandaloneResponseWire as qt, AuthenticateWithRefreshTokenOptions as qu, PublicSSO as r, AuthenticationOAuthSucceededEvent as ra, GroupResponse as rc, SerializedAuthenticateWithRadarSmsChallengeOptions as rd, GroupRoleAssignmentEntryForOrganization as rf, AgentRegistrationClaim as ri, SendRadarSmsChallengeResponseResponse as rl, EventDirectory as rm, DataIntegrationsListResponseData as rn, FlagUpdatedEvent as ro, AuthorizationCheckOptionsWithResourceId as rp, SerializedCreatePasswordlessSessionOptions as rr, PasswordResetSucceededEvent as rs, CreateObjectOptions as rt, CreateUserOptions as ru, PortalLinkResponse as s, AuthenticationPasskeySucceededEvent as sa, SerializedCreateGroupOptions as sc, AuthenticateUserWithMagicAuthCredentials as sd, SerializedGroupRoleAssignmentEntry as sf, SerializedAgentIdentity as si, RevokeSessionOptions as sl, HttpClientResponseInterface as sm, DataIntegrationsListResponseDataConnectedAccount as sn, GroupDeletedEvent as so, DeleteAuthorizationResourceByExternalIdOptions as sp, SerializedListEventOptions as sr, PermissionDeletedEvent as ss, WidgetSessionTokenResponse as st, CreateOrganizationMembershipOptions as su, ConfidentialClientOptions as t, AuthenticationOAuthFailedEvent as ta, ListGroupOrganizationMembershipsOptions as tc, AuthenticateUserWithRadarSmsChallengeCredentials as td, BaseGroupRoleAssignmentEntry as tf, AgentIdentity as ti, SendRadarSmsChallengeOptions as tl, DirectoryStateResponse as tm, DataIntegrationsListResponse as tn, FlagRuleUpdatedEvent as to, AuthorizationCheckOptions as tp, SendSessionResponse as tr, PasswordResetCreatedEvent as ts, ReadObjectResponse as tt, EmailVerificationEventResponse as tu, GenerateLinkResponse as u, AuthenticationPasswordFailedEventResponse as ua, RuntimeClientStats as uc, AuthenticateUserWithEmailVerificationCredentials as ud, RemoveGroupRoleAssignmentsOptions as uf, SerializedAgentRegistrationClaimCompletion as ui, ResetPasswordOptions as ul, ResponseHeaderValue as um, DataIntegrationsListResponseDataConnectedAccountAuthMethod as un, GroupMemberAddedEventResponse as uo, ListAuthorizationResourcesOptions as up, ApplicationCredentialsListItem as ur, PermissionUpdatedEventResponse as us, WidgetSessionTokenScopes as ut, SerializedCreateMagicAuthOptions as uu, RateLimitExceededException as v, AuthenticationSSOSucceededEventResponse as va, FlagTarget as vc, AuthenticateWithOptionsBase as vd, CreateGroupRoleAssignmentOptionsForOrganization as vf, ActionPayload as vi, PasswordResetEventResponse as vl, DataIntegrationAuthorizeUrlResponse as vn, InvitationAcceptedEventResponse as vo, SerializedUpdateAuthorizationResourceOptions as vp, ConnectApplicationRedirectUri as vr, SessionCreatedEventResponse as vs, AuditLogTarget as vt, AuthenticationFactorWithSecretsResponse as vu, AuthenticationErrorCode as w, ConnectionDeletedEventResponse as wa, ValidateApiKeyOptions as wc, ProfileAndTokenResponse as wd, GroupRoleAssignment as wf, Organization as wi, MagicAuthEventResponse as wl, DataIntegrationResponse as wn, InvitationRevokedEventResponse as wo, SerializedCreatePermissionOptions as wp, ListApplicationClientSecretsOptions as wr, UserDeletedEvent as ws, AuditLogSchemaMetadata as wt, AuthenticationEventResponse as wu, NoApiKeyProvidedException as x, ConnectionDeactivatedEvent as xa, EvaluationContext as xc, SerializedAuthenticateWithOptionsBase as xd, SerializedCreateGroupRoleAssignmentOptions as xf, UserRegistrationActionPayload as xi, CreateMagicAuthResponseResponse as xl, ConnectedAccountResponse as xn, InvitationResentEvent as xo, SerializedUpdatePermissionOptions as xp, ExternalAuthCompleteResponseWire as xr, UnknownEvent as xs, SerializedCreateAuditLogEventOptions as xt, TotpWithSecrets as xu, OauthException as y, ConnectionActivatedEvent as ya, FeatureFlag as yc, AuthenticateWithSessionOptions as yd, CreateGroupRoleAssignmentOptionsWithResourceExternalId as yf, UserData as yi, PasswordResetResponse as yl, DataIntegrationAuthorizeUrlResponseWire as yn, InvitationCreatedEvent as yo, UpdateAuthorizationResourceOptions as yp, ConnectApplicationRedirectUriResponse as yr, SessionRevokedEvent as ys, CreateAuditLogEventOptions as yt, Totp as yu, ObjectSummary as z, DsyncUserCreatedEvent as za, OrganizationDomainVerificationStrategy as zc, DefaultCustomAttributes as zd, SerializedListRoleAssignmentsForResourceOptions as zf, List as zi, OrganizationMembership as zl, CreateDataIntegrationCredentialOptions as zn, OrganizationDomainVerifiedEvent as zo, CreateEnvironmentRoleOptions as zp, UserConsentOptionChoice as zr, VaultDekDecryptedEventResponse as zs, SmsResponse as zt, CreateUserResponseResponse as zu };
+//# sourceMappingURL=factory-B8vTFojy.d.cts.map